Localize daemon notifications via stable message keys

.github/workflows/pr-title-check.yml

@@ -16,8 +16,6 @@ jobs:
             const allowedTags = [
               'management',
               'client',
-              'android',
-              'ios',
               'signal',
               'proxy',
               'relay',

.goreleaser_ui.yaml

@@ -92,15 +92,8 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-      # Names the polkit action for the elevation prompt the app raises when an
-      # unprivileged user changes a privileged setting; without it the dialog
-      # shows a raw command line.
-      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
-        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-4-1 (>= 4.14)
-      - libwebkitgtk-6.0-4
+      - netbird
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -120,15 +113,8 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-      # Names the polkit action for the elevation prompt the app raises when an
-      # unprivileged user changes a privileged setting; without it the dialog
-      # shows a raw command line.
-      - src: client/ui/build/linux/polkit/io.netbird.settings.policy
-        dst: /usr/share/polkit-1/actions/io.netbird.settings.policy
     dependencies:
-      - netbird >= 0.75.0
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - netbird
 
     rpm:
       signature:

client/android/client.go

@@ -57,12 +57,6 @@ type DnsReadyListener interface {
 	dns.ReadyListener
 }
 
-// TunSettings is a snapshot of the settings the TUN device is rebuilt with
-type TunSettings struct {
-	Routes        string
-	SearchDomains string
-}
-
 func init() {
 	formatter.SetLogcatFormatter(log.StandardLogger())
 }
@@ -82,8 +76,6 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
-	// Identifies the running profile for the SSO login hint; see profile_state.go.
-	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -104,12 +96,11 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
-	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -119,16 +110,6 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
-// authSnapshot returns the config together with the path it was loaded from, in
-// one lock: the path identifies the profile whose account email backs the login
-// hint, so reading it separately could pair one profile's config with another's
-// hint when a profile switch lands in between.
-func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
-	c.stateMu.RLock()
-	defer c.stateMu.RUnlock()
-	return c.config, c.cfgPath, c.connectClient
-}
-
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -181,7 +162,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
+	auth := NewAuthWithConfig(ctx, cfg)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -189,7 +170,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -230,7 +211,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -259,24 +240,6 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
-func (c *Client) GetTunSettings() (*TunSettings, error) {
-	cc := c.getConnectClient()
-	if cc == nil {
-		return nil, fmt.Errorf("engine not running")
-	}
-
-	e := cc.Engine()
-	if e == nil {
-		return nil, fmt.Errorf("engine not initialized")
-	}
-
-	routes, searchDomains := e.TunSettings()
-	return &TunSettings{
-		Routes:        strings.Join(routes, ";"),
-		SearchDomains: strings.Join(searchDomains, ";"),
-	}, nil
-}
-
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine.
 func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {

client/android/login.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -38,20 +36,12 @@ type Auth struct {
 }
 
 // NewAuth instantiate Auth struct and validate the management URL
-//
-// The configuration at cfgPath is reused when one is already there, and only created when it is
-// not. Building a fresh in-memory config unconditionally gives the client a new WireGuard key on
-// every call: the peer registers under that key, the key is written out, and any peer registered by
-// an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
-// the persisted config, because the identity it registered is not the one it runs with — the
-// management stream rejects it with "no peer auth method provided".
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}
@@ -63,14 +53,11 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
-// file the config was loaded from; it identifies the profile whose account email
-// backs the login_hint.
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
 	return &Auth{
-		ctx:     ctx,
-		config:  config,
-		cfgPath: cfgPath,
+		ctx:    ctx,
+		config: config,
 	}
 }
 
@@ -163,14 +150,12 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
-	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
-		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -178,42 +163,17 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
-	// Stored after Login, not before: a rejected token must not leave a hint
-	// pointing at an account that cannot be used.
-	if email != "" && a.cfgPath != "" {
-		if err := writeProfileEmail(a.cfgPath, email); err != nil {
-			log.Warnf("failed to store profile account email: %v", err)
-		}
-	}
-
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
-// loginHintSetter is implemented by both concrete flows (PKCE and device code)
-// but absent from the OAuthFlow interface, hence the assertion below — the same
-// way internal/auth wires it in authenticateWithPKCEFlow.
-type loginHintSetter interface {
-	SetLoginHint(hint string)
-}
-
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
-	// leaves the choice to the IdP, which is how accounts get switched.
-	if a.cfgPath != "" {
-		if hint := readProfileEmail(a.cfgPath); hint != "" {
-			if setter, ok := oAuthFlow.(loginHintSetter); ok {
-				setter.SetLoginHint(hint)
-			}
-		}
-	}
-
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/login_test.go

@@ -1,51 +0,0 @@
-package android
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-// NewAuth must reuse the configuration already at cfgPath rather than building a fresh one.
-//
-// Creating a new in-memory config on every call gives the client a new WireGuard private key each
-// time. The peer registers under that key and the key is written out, so a peer registered by an
-// earlier call is orphaned on the server — a client that enrols twice leaves two entries and owns
-// neither. It also breaks enrol-then-run: RunWithoutLogin reloads the configuration from disk, so
-// the identity that registered is not the identity that runs, and the management stream rejects it
-// with "no peer auth method provided, please use a setup key or interactive SSO login".
-func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	first, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("first NewAuth: %v", err)
-	}
-	if first.config.PrivateKey == "" {
-		t.Fatal("first NewAuth produced no private key")
-	}
-
-	second, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("second NewAuth: %v", err)
-	}
-
-	if second.config.PrivateKey != first.config.PrivateKey {
-		t.Errorf("private key changed between calls: a second enrolment would orphan the peer registered by the first")
-	}
-}
-
-// A missing configuration is still created, so a first enrolment works unchanged.
-func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	auth, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("NewAuth: %v", err)
-	}
-	if auth.config == nil || auth.config.PrivateKey == "" {
-		t.Fatal("NewAuth did not create a usable configuration")
-	}
-	if auth.cfgPath != cfgPath {
-		t.Errorf("cfgPath = %q, want %q", auth.cfgPath, cfgPath)
-	}
-}

client/android/profile_manager.go

@@ -13,17 +13,18 @@ import (
 )
 
 const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID   string
-	Name string
-	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login or was logged out. See profile_state.go.
-	Email    string
+	ID       string
+	Name     string
 	IsActive bool
 }
 
@@ -100,7 +101,6 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
-			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,22 +123,7 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{
-		ID:       prof.ID.String(),
-		Name:     prof.Name,
-		Email:    pm.profileEmail(prof.ID.String()),
-		IsActive: true,
-	}, nil
-}
-
-// profileEmail returns the account email recorded for a profile. Display-only, so
-// an unresolvable path degrades to "" rather than an error.
-func (pm *ProfileManager) profileEmail(id string) string {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return ""
-	}
-	return readProfileEmail(configPath)
+	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
 }
 
 // SwitchProfile switches to a different profile
@@ -200,11 +185,6 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// Not fatal: a stale hint costs an account switch, not the logout itself.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -1,108 +0,0 @@
-package android
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/util"
-)
-
-const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// profileAccountSuffix names the file holding the profile's account email.
-	// Deliberately not ".state.json", which desktop uses for the same data:
-	// there the email and the engine's state manager live in different
-	// directories, but on Android both resolve under files/, so sharing the name
-	// would have the two overwrite each other — the state manager rewrites the
-	// whole file from its own keys (see statemanager.Manager.PersistState), and
-	// this package's writer does the same in reverse.
-	profileAccountSuffix = ".account.json"
-)
-
-// profileAccountPathFor derives the account file path from a profile's config
-// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
-//
-// Deriving from the config path rather than resolving the active profile keeps
-// the write on the profile the login actually ran for: Auth.login runs in a
-// goroutine, so the active profile can change under a flow already in flight.
-func profileAccountPathFor(configPath string) (string, error) {
-	if configPath == "" {
-		return "", fmt.Errorf("empty config path")
-	}
-
-	base := filepath.Base(configPath)
-	stem := strings.TrimSuffix(base, filepath.Ext(base))
-	if stem == "" || stem == "." {
-		return "", fmt.Errorf("config path %q has no filename stem", configPath)
-	}
-
-	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
-}
-
-// readProfileEmail returns the account email stored for the profile whose config
-// lives at configPath. A missing or unreadable file yields "", which leaves the
-// account choice to the IdP.
-func readProfileEmail(configPath string) string {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		log.Debugf("no profile account path for login hint: %v", err)
-		return ""
-	}
-
-	var state profilemanager.ProfileState
-	if _, err := util.ReadJson(accountPath, &state); err != nil {
-		if !os.IsNotExist(err) {
-			log.Debugf("failed to read profile account for login hint: %v", err)
-		}
-		return ""
-	}
-
-	return state.Email
-}
-
-// writeProfileEmail records the account email for the profile whose config lives
-// at configPath, so later logins can pass it as an OIDC login_hint. An empty
-// email is ignored rather than blanking what is already stored.
-func writeProfileEmail(configPath string, email string) error {
-	if email == "" {
-		return nil
-	}
-
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	state := profilemanager.ProfileState{Email: email}
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
-		return fmt.Errorf("write profile account: %w", err)
-	}
-
-	return nil
-}
-
-// removeProfileEmail drops the stored account email. Called on logout: while the
-// email is on disk it goes out as a login_hint, which would steer the next login
-// straight back into the account just logged out of. Mirrors the desktop UI's
-// RemoveProfileState call.
-func removeProfileEmail(configPath string) error {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("remove profile account: %w", err)
-	}
-
-	return nil
-}

client/android/profile_state_test.go

@@ -1,161 +0,0 @@
-package android
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestProfileAccountPathFor(t *testing.T) {
-	tests := []struct {
-		name       string
-		configPath string
-		want       string
-		wantErr    bool
-	}{
-		{
-			name:       "default profile",
-			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/netbird.account.json"),
-		},
-		{
-			name:       "id profile",
-			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
-		},
-		{
-			name:       "legacy name-keyed profile is handled the same way",
-			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/work.account.json"),
-		},
-		{
-			name:       "empty path is rejected",
-			configPath: "",
-			wantErr:    true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := profileAccountPathFor(tt.configPath)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected an error, got path %q", got)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Errorf("got %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
-	if err != nil {
-		t.Fatalf("default profile: %v", err)
-	}
-
-	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
-	if err != nil {
-		t.Fatalf("id profile: %v", err)
-	}
-
-	if defaultAccount == idAccount {
-		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
-	}
-}
-
-// The account file must never land on the engine state file: on Android both
-// resolve under files/, and the state manager rewrites the whole file from its
-// own keys, so sharing a path would have the two overwrite each other. The
-// expected names here mirror ProfileManager.GetStateFilePath.
-func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	cases := []struct {
-		configPath  string
-		engineState string
-	}{
-		{
-			configPath:  filepath.Join(root, defaultConfigFilename),
-			engineState: filepath.Join(root, "state.json"),
-		},
-		{
-			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
-			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
-		},
-	}
-
-	for _, c := range cases {
-		account, err := profileAccountPathFor(c.configPath)
-		if err != nil {
-			t.Fatalf("%s: %v", c.configPath, err)
-		}
-		if account == c.engineState {
-			t.Errorf("account file collides with the engine state file: %q", account)
-		}
-	}
-}
-
-func TestWriteThenReadProfileEmail(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email before a login, got %q", got)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("got %q, want %q", got, email)
-	}
-
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("remove: %v", err)
-	}
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after logout, got %q", got)
-	}
-
-	// Logout may run on a never-logged-in profile, so a second remove must pass.
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("second remove should be a no-op: %v", err)
-	}
-}
-
-func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if err := writeProfileEmail(configPath, ""); err != nil {
-		t.Fatalf("write empty: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
-	}
-}
-
-func ensureDirFor(t *testing.T, path string) error {
-	t.Helper()
-	return os.MkdirAll(filepath.Dir(path), 0o700)
-}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, cfgPath, cc := c.authSnapshot()
+	cfg, _, cc := c.stateSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,10 +293,7 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
-	a := NewAuthWithConfig(ctx, cfg, cfgPath)
+	a := &Auth{ctx: ctx, config: cfg}
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/internal/auth/sessionwatch/event.go

@@ -11,10 +11,11 @@ import (
 // emits.
 
 // Metadata keys attached by the daemon to session-warning SystemEvents.
-// The UI tray reads these to build a locale-aware notification without
-// relying on the daemon's locale-less UserMessage string, and to
-// disambiguate the T-WarningLead notification from the T-FinalWarningLead
-// fallback that auto-opens the SessionAboutToExpire dialog.
+// The notification text itself travels as a message key (see
+// proto.UserMsgSessionExpiresIn); these keys carry the structured deadline
+// the UI needs for its own countdown label, and disambiguate the
+// T-WarningLead notification from the T-FinalWarningLead fallback that
+// auto-opens the SessionAboutToExpire dialog.
 const (
 	// MetaSessionWarning is set to "true" on both warning events (T-10 and
 	// T-2) so the UI can detect a session-warning SystemEvent without
@@ -36,10 +37,9 @@ const (
 	// MetaSessionDeadlineRejected is attached to the ERROR/AUTHENTICATION
 	// SystemEvent the daemon emits when it discards a deadline from the
 	// management server (pre-epoch, too far in the future, or past the
-	// clock-skew tolerance). The value is the rejection reason string.
-	// userMessage is left empty; the UI detects the event via this key
-	// and builds a localized notification — same pattern as the session
-	// warnings above.
+	// clock-skew tolerance). The value is the rejection reason string,
+	// which is diagnostic only: the user-facing text travels as
+	// proto.UserMsgSessionDeadlineReject.
 	MetaSessionDeadlineRejected = "session_deadline_rejected"
 )
 

client/internal/auth/sessionwatch/watcher.go

@@ -21,6 +21,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	cProto "github.com/netbirdio/netbird/client/proto"
+	nbstatus "github.com/netbirdio/netbird/client/status"
 )
 
 const (
@@ -80,7 +81,7 @@ type StatusRecorder interface {
 		severity cProto.SystemEvent_Severity,
 		category cProto.SystemEvent_Category,
 		message string,
-		userMessage string,
+		userMessage *cProto.UserMessage,
 		metadata map[string]string,
 	)
 }
@@ -376,7 +377,22 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_AUTHENTICATION,
 		message,
-		"",
+		warningUserMessage(deadline),
 		meta,
 	)
 }
+
+// warningUserMessage builds the localizable body for a session warning. The
+// remaining time is rendered here rather than in the UI so every consumer of the
+// event agrees on it; a deadline that is already gone (a warning delivered late)
+// drops to the variant without a countdown.
+func warningUserMessage(deadline time.Time) *cProto.UserMessage {
+	remaining := time.Until(deadline)
+	if remaining <= 0 {
+		return cProto.NewUserMessage(cProto.UserMsgSessionExpiresSoon).
+			WithTitle(cProto.TitleSessionWarning)
+	}
+	return cProto.NewUserMessage(cProto.UserMsgSessionExpiresIn,
+		cProto.ArgRemaining, nbstatus.HumaniseDuration(remaining)).
+		WithTitle(cProto.TitleSessionWarning)
+}

client/internal/auth/sessionwatch/watcher_test.go

@@ -34,6 +34,9 @@ type event struct {
 	severity cProto.SystemEvent_Severity
 	category cProto.SystemEvent_Category
 	message  string
+	msgKey   cProto.UserMessageKey
+	titleKey cProto.UserMessageKey
+	msgArgs  map[string]string
 	meta     map[string]string
 }
 
@@ -62,7 +65,7 @@ func (r *fakeRecorder) PublishEvent(
 	severity cProto.SystemEvent_Severity,
 	category cProto.SystemEvent_Category,
 	message string,
-	_ string,
+	userMessage *cProto.UserMessage,
 	metadata map[string]string,
 ) {
 	r.mu.Lock()
@@ -72,6 +75,9 @@ func (r *fakeRecorder) PublishEvent(
 		severity: severity,
 		category: category,
 		message:  message,
+		msgKey:   userMessage.Key(),
+		titleKey: userMessage.TitleKey(),
+		msgArgs:  userMessage.Args(),
 		meta:     metadata,
 	})
 }
@@ -186,6 +192,33 @@ func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
 	}
 }
 
+// The UI localizes the warning body from the key rather than from the daemon's
+// English text, so a warning that ships no key would silently regress to English.
+func TestWarningCarriesLocalizableMessage(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	_ = w.Update(time.Now().Add(80 * time.Millisecond))
+
+	events := waitForEvents(t, r, 2)
+	warning := events[1]
+	if !warning.isWarning() {
+		t.Fatalf("event[1] should be a warning publish, got %+v", warning)
+	}
+	if warning.msgKey != cProto.UserMsgSessionExpiresIn {
+		t.Errorf("warning message key = %q, want %q", warning.msgKey, cProto.UserMsgSessionExpiresIn)
+	}
+	if warning.titleKey != cProto.TitleSessionWarning {
+		t.Errorf("warning title key = %q, want %q", warning.titleKey, cProto.TitleSessionWarning)
+	}
+	// The remaining time is rendered at publish time so every consumer of the
+	// event agrees on it; the exact value depends on timer slack.
+	if remaining := warning.msgArgs[cProto.ArgRemaining]; remaining == "" {
+		t.Errorf("warning is missing the %q argument, args=%v", cProto.ArgRemaining, warning.msgArgs)
+	}
+}
+
 func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r) // lead > delta => fire immediately

client/internal/connect.go

@@ -113,14 +113,11 @@ func (c *ConnectClient) RunOnAndroid(
 	stateFilePath string,
 	cacheDir string,
 ) error {
-	notifier := tunnelnotifier.New(networkChangeListener, nil)
-	defer notifier.Close()
-
 	// in case of non Android os these variables will be nil
 	mobileDependency := MobileDependency{
 		TunAdapter:            tunAdapter,
 		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: notifier,
+		NetworkChangeListener: networkChangeListener,
 		HostDNSAddresses:      dnsAddresses,
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,
@@ -166,7 +163,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 				rec.PublishEvent(
 					cProto.SystemEvent_CRITICAL, cProto.SystemEvent_SYSTEM,
 					"panic occurred",
-					"The Netbird service panicked. Please restart the service and submit a bug report with the client logs.",
+					cProto.NewUserMessage(cProto.UserMsgPanic),
 					nil,
 				)
 			}

client/internal/daemonaddr/identity.go

@@ -1,17 +0,0 @@
-package daemonaddr
-
-import "strings"
-
-// CarriesIdentity reports whether the control channel at addr conveys the
-// connecting process's identity to the daemon. A Unix socket carries peer
-// credentials and a named pipe carries the client's token. Nothing else does, TCP
-// included, and there the daemon can authorize a privileged operation for nobody
-// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
-// Windows daemon on the address it served before it had a pipe.
-//
-// A client uses this to tell whether becoming privileged would get it anywhere.
-// It answers from the scheme and nothing else, so an address it does not
-// recognise counts as carrying no identity.
-func CarriesIdentity(addr string) bool {
-	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
-}

client/internal/daemonaddr/identity_test.go

@@ -1,29 +0,0 @@
-package daemonaddr
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCarriesIdentity(t *testing.T) {
-	tests := []struct {
-		addr string
-		want bool
-	}{
-		{"unix:///var/run/netbird.sock", true},
-		{"unix:///var/run/netbird/default.sock", true},
-		{"npipe://netbird", true},
-		{`npipe://\\.\pipe\ProtectedPrefix\Administrators\netbird`, true},
-		{"tcp://127.0.0.1:41731", false},
-		{"tcp://localhost:41731", false},
-		{"", false},
-		{"/var/run/netbird.sock", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.addr, func(t *testing.T) {
-			assert.Equal(t, tt.want, CarriesIdentity(tt.addr), "address %q", tt.addr)
-		})
-	}
-}

client/internal/dns/notifier.go

@@ -51,5 +51,7 @@ func (n *notifier) notify() {
 		return
 	}
 
-	n.listener.OnNetworkChanged("")
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged("")
+	}(n.listener)
 }

client/internal/dns/server.go

@@ -252,7 +252,7 @@ func NewDefaultServerPermanentUpstream(
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.currentConfig = dnsConfigToHostDNSConfig(config, ds.service.RuntimeIP(), ds.service.RuntimePort())
-	ds.searchDomainNotifier = newNotifier(ds.searchDomains())
+	ds.searchDomainNotifier = newNotifier(ds.SearchDomains())
 	ds.searchDomainNotifier.setListener(listener)
 	setServerDns(ds)
 	return ds
@@ -602,12 +602,6 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 }
 
 func (s *DefaultServer) SearchDomains() []string {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	return s.searchDomains()
-}
-
-func (s *DefaultServer) searchDomains() []string {
 	var searchDomains []string
 
 	for _, dConf := range s.currentConfig.Domains {
@@ -692,7 +686,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 	}()
 
 	if s.searchDomainNotifier != nil {
-		s.searchDomainNotifier.onNewSearchDomains(s.searchDomains())
+		s.searchDomainNotifier.onNewSearchDomains(s.SearchDomains())
 	}
 
 	s.updateNSGroupStates(update.NameServerGroups)
@@ -1140,7 +1134,7 @@ func (s *DefaultServer) projectHealthy(p *nsGroupProj, servers []netip.AddrPort)
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_DNS,
 		"Nameserver group recovered",
-		"DNS servers are reachable again.",
+		proto.NewUserMessage(proto.UserMsgDNSRecovered),
 		map[string]string{"upstreams": joinAddrPorts(servers)},
 	)
 	p.warningActive = false
@@ -1163,7 +1157,7 @@ func (s *DefaultServer) projectUnhealthy(p *nsGroupProj, servers []netip.AddrPor
 			proto.SystemEvent_WARNING,
 			proto.SystemEvent_DNS,
 			"Nameserver group unreachable",
-			"Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+			proto.NewUserMessage(proto.UserMsgDNSUnreachable),
 			map[string]string{"upstreams": joinAddrPorts(servers)},
 		)
 		p.warningActive = true

client/internal/elevate/elevate.go

@@ -1,74 +0,0 @@
-// Package elevate re-runs this very executable under the operating system's own
-// privilege-elevation mechanism and waits for it to finish.
-//
-// It exists so that a change the daemon restricts to root/administrator can be
-// authorized from the GUI, by the user, at the moment they ask for it: Windows
-// shows the UAC consent dialog, macOS the system authentication dialog, and
-// Linux/FreeBSD the session's polkit agent. The credentials, where any are
-// asked for, are collected by the operating system and never pass through
-// NetBird.
-//
-// What the elevated process then does is the caller's business: it is the same
-// binary, in a one-shot mode, and it is authorized by the daemon exactly like
-// any other privileged caller, from the identity the kernel reports on the
-// control channel. Nothing here grants privilege, and the daemon gains no new
-// way to be talked into something: elevation only changes who is calling it.
-package elevate
-
-import (
-	"context"
-	"errors"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// AppliedMarker is what the elevated process prints on standard output once it has
-// done what it was run for.
-//
-// macOS's AuthorizationExecuteWithPrivileges reports no exit status and does not
-// say which process it started, so there this line is the only evidence that the
-// change was applied. The other platforms have an exit code and ignore it.
-const AppliedMarker = "netbird-elevated: applied"
-
-var (
-	// ErrDeclined reports that the user dismissed the prompt or did not
-	// authenticate. Nothing happened and nothing is wrong: a caller undoes its
-	// optimistic update and stays quiet.
-	ErrDeclined = errors.New("authorization declined")
-
-	// ErrUnavailable reports that this host has no elevation mechanism we can
-	// drive: no polkit on a Unix desktop, or an executable we decline to run as
-	// root. A caller falls back to telling the user which command to run.
-	ErrUnavailable = errors.New("no privilege elevation mechanism available")
-)
-
-// Run runs this executable with args under the platform's elevation mechanism
-// and waits for it to exit. A non-zero exit is returned as an error, so the
-// caller can treat a completed Run as the operation having succeeded.
-//
-// The args are the caller's own command line, so they cross no privilege
-// boundary: only a user who has just authenticated as an administrator can get
-// them run at all.
-func Run(ctx context.Context, args ...string) error {
-	self, err := trustedSelf()
-	if err != nil {
-		return err
-	}
-	return run(ctx, self, args)
-}
-
-// Available reports whether Run has a mechanism to use on this host, so a caller
-// can offer the prompt only when there is one and otherwise fall back to
-// guidance the user can act on. It answers from what is installed, not from what
-// the user is allowed to do: an administrator's password may still be required
-// and may still not be given, which is ErrDeclined from Run.
-func Available() bool {
-	if _, err := trustedSelf(); err != nil {
-		// Worth a line: this is also what a build run from a group-writable
-		// directory hits, and there is nothing in the UI to say why the offer is
-		// missing.
-		log.Debugf("not offering privilege elevation: %v", err)
-		return false
-	}
-	return mechanismAvailable()
-}

client/internal/elevate/output.go

@@ -1,18 +0,0 @@
-package elevate
-
-import "strings"
-
-// noOutput stands in for a process that said nothing, so that a report of what it
-// said still reads as a sentence.
-const noOutput = "no output"
-
-func firstLine(s string) string {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return noOutput
-	}
-	if i := strings.IndexByte(s, '\n'); i >= 0 {
-		return s[:i]
-	}
-	return s
-}

client/internal/elevate/output_test.go

@@ -1,21 +0,0 @@
-package elevate
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestFirstLine(t *testing.T) {
-	tests := []struct{ in, want string }{
-		{in: "", want: noOutput},
-		{in: "  \n ", want: noOutput},
-		{in: "one line", want: "one line"},
-		{in: "first\nsecond", want: "first"},
-		{in: "\nsecond\n", want: "second"},
-	}
-
-	for _, tt := range tests {
-		assert.Equal(t, tt.want, firstLine(tt.in), "input %q", tt.in)
-	}
-}

client/internal/elevate/run_darwin.go

@@ -1,359 +0,0 @@
-package elevate
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"runtime"
-	"strings"
-	"sync"
-	"syscall"
-	"unsafe"
-
-	"github.com/ebitengine/purego"
-	log "github.com/sirupsen/logrus"
-)
-
-// Authorization Services, reached through purego rather than cgo so the released
-// binaries keep building with CGO_ENABLED=0.
-//
-// The prompt belongs to this process, which is what makes it carry the
-// application's name and our own explanation. Going through osascript instead puts
-// the very same trampoline behind a dialog attributed to osascript, and means
-// handing a shell a command line to re-parse.
-//
-// # On AuthorizationExecuteWithPrivileges
-//
-// It is deprecated, and Apple's guidance (Quinn, "BSD Privilege Escalation on
-// macOS", developer.apple.com/forums/thread/708765) is "while it still works, it's
-// been deprecated for many years. Do not use it in a widely distributed product."
-// It is used here anyway, knowingly, because the alternatives Apple offers are for
-// *obtaining* ongoing privileges — an installer package, SMAppService, SMJobBless —
-// and NetBird already has what they would install: a launchd daemon running as
-// root. What is missing is only a way for an unprivileged client to ask it to act.
-//
-// The way to that without a deprecated call is to authorize the client instead of
-// elevating one: the app takes the right with AuthorizationCreate, passes the
-// AuthorizationExternalForm to the daemon, and the daemon checks it with
-// AuthorizationCopyRights before acting — none of which is deprecated. It is the
-// better design and it is where this should end up. It also means the daemon
-// accepting an authorization over its control socket, which is a new way to be
-// asked for privileged work and wants reviewing as such, so it is deliberately not
-// bundled in with the rest of this.
-//
-// Until then, three things keep the deprecation from being a trap. Every symbol is
-// resolved with an error rather than a panic, so a macOS that has dropped this
-// function leaves the app offering the user a command instead of crashing on the
-// way to a prompt. A failure to run the tool is reported as ErrUnavailable, so the
-// fallback is the same one an agent-less Linux session gets. And the whole path
-// runs under guard, which turns a panic out of the FFI layer into that same
-// fallback.
-//
-// The trampoline passes on the environment it was given, so what it starts as root
-// must be an executable this user's peers cannot influence: that is what
-// trustedSelf refuses, and what signing the binary settles for the loader.
-
-const (
-	securityFramework = "/System/Library/Frameworks/Security.framework/Security"
-	libSystem         = "/usr/lib/libSystem.B.dylib"
-
-	// trampoline is what the framework hands the tool to. Present on every macOS,
-	// and worth confirming before offering a prompt rather than mid-prompt.
-	trampoline = "/usr/libexec/security_authtrampoline"
-)
-
-// rightExecute is the right an administrator holds, and what
-// AuthorizationExecuteWithPrivileges requires of us.
-const rightExecute = "system.privilege.admin"
-
-// promptKey is kAuthorizationEnvironmentPrompt, which puts a sentence of ours above
-// the system's in the dialog. It is about the change rather than the mechanism.
-const (
-	promptKey  = "prompt"
-	promptText = "NetBird needs to change a setting that grants SSH access to this computer."
-)
-
-// OSStatus values from SecBase.h that mean something to us; anything else is
-// reported as it comes.
-const (
-	errAuthorizationSuccess               = 0
-	errAuthorizationDenied                = -60005
-	errAuthorizationCanceled              = -60006
-	errAuthorizationInteractionNotAllowed = -60007
-	errAuthorizationToolExecuteFailure    = -60031
-	errAuthorizationToolEnvironmentError  = -60032
-)
-
-// AuthorizationFlags from Authorization.h.
-const (
-	flagDefaults           = 0
-	flagInteractionAllowed = 1 << 0
-	flagExtendRights       = 1 << 1
-	flagDestroyRights      = 1 << 3
-	flagPreAuthorize       = 1 << 4
-)
-
-// authorizationItem mirrors AuthorizationItem: a name, and a value the name gives
-// meaning to. 32 bytes on both amd64 and arm64.
-type authorizationItem struct {
-	name        *byte
-	valueLength uintptr
-	value       unsafe.Pointer
-	// flags is reserved by the API and always zero. Declared because the layout
-	// is the contract: without it the struct is 24 bytes where C reads 32.
-	flags uint32 //nolint:unused // part of the C layout
-}
-
-// authorizationItemSet mirrors AuthorizationItemSet, which serves as both an
-// AuthorizationRights and an AuthorizationEnvironment.
-type authorizationItemSet struct {
-	count uint32
-	items *authorizationItem
-}
-
-var (
-	authorizationCreate                func(rights, environment *authorizationItemSet, flags uint32, authorization *uintptr) int32
-	authorizationExecuteWithPrivileges func(authorization uintptr, pathToTool string, options uint32, arguments *uintptr, communicationsPipe *uintptr) int32
-	authorizationFree                  func(authorization uintptr, flags uint32) int32
-	fileno                             func(stream uintptr) int32
-	fclose                             func(stream uintptr) int32
-
-	loadOnce sync.Once
-	loadErr  error
-)
-
-// load resolves the functions once. A framework that cannot be opened, or a symbol
-// that is no longer there, leaves the host without a mechanism rather than taking
-// the process down with it: see the note on deprecation above.
-func load() error {
-	loadOnce.Do(func() { loadErr = guard("loading Security.framework", resolve) })
-	return loadErr
-}
-
-// guard turns a panic out of the FFI layer into an error, so an API that has
-// changed under us costs the user a prompt rather than the window they were
-// clicking in. purego panics on a signature it cannot map, and this is the one
-// place in the client that calls a deprecated system function.
-//
-// It catches Go panics, which is what purego raises. A fault inside the framework
-// itself is not a panic and not recoverable; the layout the tests pin down is what
-// stands between us and that.
-func guard(what string, fn func() error) (err error) {
-	defer func() {
-		r := recover()
-		if r == nil {
-			return
-		}
-		log.Errorf("%s panicked: %v", what, r)
-		err = fmt.Errorf("%w: %s: %v", ErrUnavailable, what, r)
-	}()
-	return fn()
-}
-
-func resolve() error {
-	security, err := purego.Dlopen(securityFramework, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
-	if err != nil {
-		return fmt.Errorf("open %s: %w", securityFramework, err)
-	}
-	system, err := purego.Dlopen(libSystem, purego.RTLD_LAZY|purego.RTLD_GLOBAL)
-	if err != nil {
-		return fmt.Errorf("open %s: %w", libSystem, err)
-	}
-
-	// purego.RegisterLibFunc panics on a symbol it cannot find, which is not how a
-	// deprecated function's disappearance should reach the user.
-	for _, fn := range []struct {
-		ptr    any
-		handle uintptr
-		name   string
-	}{
-		{&authorizationCreate, security, "AuthorizationCreate"},
-		{&authorizationExecuteWithPrivileges, security, "AuthorizationExecuteWithPrivileges"},
-		{&authorizationFree, security, "AuthorizationFree"},
-		{&fileno, system, "fileno"},
-		{&fclose, system, "fclose"},
-	} {
-		symbol, err := purego.Dlsym(fn.handle, fn.name)
-		if err != nil {
-			return fmt.Errorf("resolve %s: %w", fn.name, err)
-		}
-		if symbol == 0 {
-			return fmt.Errorf("resolve %s: not present on this system", fn.name)
-		}
-		purego.RegisterFunc(fn.ptr, symbol)
-	}
-	return nil
-}
-
-// run asks the system to run self as root: first for the right, which is what puts
-// up the authentication dialog and collects the password or takes the Touch ID,
-// then for the tool. The credentials go to the system's authorization trampoline
-// and never to us.
-//
-// The context bounds only our own waiting; the dialog belongs to the system and
-// closes when the user answers it.
-func run(ctx context.Context, self string, args []string) error {
-	if err := load(); err != nil {
-		return fmt.Errorf("%w: %v", ErrUnavailable, err)
-	}
-
-	return guard("asking for privileges", func() error {
-		authorization, err := authorize()
-		if err != nil {
-			return err
-		}
-		defer authorizationFree(authorization, flagDestroyRights)
-
-		return execute(ctx, authorization, self, args)
-	})
-}
-
-func mechanismAvailable() bool {
-	if err := load(); err != nil {
-		return false
-	}
-	info, err := os.Stat(trampoline)
-	return err == nil && !info.IsDir()
-}
-
-// authorize obtains the right, prompting for it. A dismissed dialog comes back as
-// errAuthorizationCanceled and a password given up on as errAuthorizationDenied;
-// both are the user's answer rather than a failure.
-func authorize() (uintptr, error) {
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
-	environment := itemSet(&pinner, promptItem(&pinner))
-
-	var authorization uintptr
-	status := authorizationCreate(rights, environment,
-		flagDefaults|flagInteractionAllowed|flagPreAuthorize|flagExtendRights, &authorization)
-
-	switch status {
-	case errAuthorizationSuccess:
-		return authorization, nil
-	case errAuthorizationCanceled, errAuthorizationDenied:
-		return 0, ErrDeclined
-	case errAuthorizationInteractionNotAllowed:
-		// Nowhere to put a dialog, so there is nobody to ask: a launch daemon, or
-		// a session with no window server.
-		return 0, fmt.Errorf("%w: this session cannot show an authorization prompt", ErrUnavailable)
-	default:
-		return 0, fmt.Errorf("request %s: OSStatus %d", rightExecute, status)
-	}
-}
-
-// execute runs the tool with the right in hand and waits for it by reading the pipe
-// it is given until the tool closes it.
-//
-// AuthorizationExecuteWithPrivileges reports no exit status and does not say what
-// process it started, which is why the one-shot says so itself: what it prints is
-// the only evidence that the change was applied.
-func execute(ctx context.Context, authorization uintptr, self string, args []string) error {
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	argv := make([]uintptr, 0, len(args)+1)
-	for _, arg := range args {
-		argv = append(argv, uintptr(unsafe.Pointer(cString(&pinner, arg))))
-	}
-	argv = append(argv, 0)
-	pinner.Pin(&argv[0])
-
-	var pipe uintptr
-	status := authorizationExecuteWithPrivileges(authorization, self, flagDefaults, &argv[0], &pipe)
-	switch status {
-	case errAuthorizationSuccess:
-	case errAuthorizationCanceled:
-		return ErrDeclined
-	case errAuthorizationToolExecuteFailure, errAuthorizationToolEnvironmentError:
-		// The right was granted and the tool still did not start. Nothing the user
-		// can do about it from here, so point them at the command instead.
-		return fmt.Errorf("%w: the system would not run %s elevated (OSStatus %d)", ErrUnavailable, self, status)
-	default:
-		return fmt.Errorf("run %s elevated: OSStatus %d", self, status)
-	}
-
-	out, err := readPipe(ctx, pipe)
-	if err != nil {
-		return err
-	}
-	return checkApplied(out)
-}
-
-// checkApplied reads the one-shot's report, which stands in for the exit status
-// there is no way to ask for here. A run that said nothing did not apply the
-// change, whatever else went on.
-func checkApplied(out string) error {
-	if !strings.Contains(out, AppliedMarker) {
-		return fmt.Errorf("elevated netbird did not report the change as applied: %s", firstLine(out))
-	}
-	return nil
-}
-
-// readPipe drains the tool's output, which ends when the tool exits and is
-// therefore also how we wait for it.
-func readPipe(ctx context.Context, pipe uintptr) (string, error) {
-	if pipe == 0 {
-		return "", nil
-	}
-	defer fclose(pipe)
-
-	fd := int(fileno(pipe))
-	if fd < 0 {
-		return "", nil
-	}
-
-	var out strings.Builder
-	buf := make([]byte, 4096)
-	for {
-		if err := ctx.Err(); err != nil {
-			return out.String(), err
-		}
-		n, err := syscall.Read(fd, buf)
-		if n > 0 {
-			out.Write(buf[:n])
-		}
-		switch {
-		case errors.Is(err, syscall.EINTR):
-			// A signal landed mid-read, which says nothing about the tool.
-			continue
-		case err != nil:
-			log.Debugf("read the elevated process's output: %v", err)
-			return out.String(), nil
-		case n <= 0:
-			// End of file: the tool closed the pipe, which is how it exiting
-			// reaches us.
-			return out.String(), nil
-		}
-	}
-}
-
-// itemSet builds an AuthorizationItemSet over items, pinned for the call.
-func itemSet(pinner *runtime.Pinner, items ...authorizationItem) *authorizationItemSet {
-	pinner.Pin(&items[0])
-	set := &authorizationItemSet{count: uint32(len(items)), items: &items[0]}
-	pinner.Pin(set)
-	return set
-}
-
-// promptItem is the environment entry carrying our sentence for the dialog.
-func promptItem(pinner *runtime.Pinner) authorizationItem {
-	value := []byte(promptText)
-	pinner.Pin(&value[0])
-	return authorizationItem{
-		name:        cString(pinner, promptKey),
-		valueLength: uintptr(len(value)),
-		value:       unsafe.Pointer(&value[0]),
-	}
-}
-
-// cString returns a NUL-terminated copy of s, pinned so the C side may hold it for
-// the duration of the call.
-func cString(pinner *runtime.Pinner, s string) *byte {
-	b := append([]byte(s), 0)
-	pinner.Pin(&b[0])
-	return &b[0]
-}

client/internal/elevate/run_darwin_test.go

@@ -1,111 +0,0 @@
-package elevate
-
-import (
-	"errors"
-	"runtime"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The framework has to load and the symbols have to resolve, or nothing else here
-// means anything.
-func TestSecurityFrameworkLoads(t *testing.T) {
-	require.NoError(t, load(), "Security.framework must open")
-
-	for name, fn := range map[string]any{
-		"AuthorizationCreate":                authorizationCreate,
-		"AuthorizationExecuteWithPrivileges": authorizationExecuteWithPrivileges,
-		"AuthorizationFree":                  authorizationFree,
-		"fileno":                             fileno,
-		"fclose":                             fclose,
-	} {
-		assert.NotNil(t, fn, "%s must resolve", name)
-	}
-}
-
-// A request with no interaction allowed exercises the whole call — the rights and
-// environment structs, and the OSStatus that comes back — without a dialog anybody
-// has to answer. What the system decides is its business; that it decides at all is
-// what this asserts.
-func TestAuthorizationCreateWithoutInteraction(t *testing.T) {
-	if err := load(); err != nil {
-		t.Skipf("Security.framework did not open: %v", err)
-	}
-
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, rightExecute)})
-	environment := itemSet(&pinner, promptItem(&pinner))
-	require.EqualValues(t, 1, rights.count, "the rights struct layout must match the C one")
-
-	var authorization uintptr
-	status := authorizationCreate(rights, environment, flagDefaults|flagExtendRights, &authorization)
-
-	switch status {
-	case errAuthorizationSuccess:
-		// Credentials were already cached for this session.
-		authorizationFree(authorization, flagDestroyRights)
-	case errAuthorizationDenied, errAuthorizationInteractionNotAllowed:
-		// The expected answers when nobody may be asked.
-	default:
-		require.Failf(t, "unknown OSStatus", "AuthorizationCreate returned %d, want a status we recognise", status)
-	}
-}
-
-// Asking with a right nobody has must not be mistaken for a declined prompt: the
-// caller would report nothing at all.
-func TestAuthorizeUnknownRightIsNotDeclined(t *testing.T) {
-	if err := load(); err != nil {
-		t.Skipf("Security.framework did not open: %v", err)
-	}
-
-	var pinner runtime.Pinner
-	defer pinner.Unpin()
-
-	rights := itemSet(&pinner, authorizationItem{name: cString(&pinner, "io.netbird.right.that.does.not.exist")})
-
-	var authorization uintptr
-	status := authorizationCreate(rights, nil, flagDefaults|flagExtendRights, &authorization)
-	if status == errAuthorizationSuccess {
-		authorizationFree(authorization, flagDestroyRights)
-	}
-	assert.NotEqual(t, int32(errAuthorizationSuccess), status, "a right that does not exist must not be granted")
-}
-
-func TestMechanismAvailable(t *testing.T) {
-	assert.True(t, mechanismAvailable(), "the trampoline exists on every macOS")
-}
-
-// The one-shot's report is what stands in for an exit status here, so a run that
-// says nothing must not read as success.
-func TestCheckApplied(t *testing.T) {
-	require.NoError(t, checkApplied(AppliedMarker+"\n"), "the report the one-shot prints")
-	require.NoError(t, checkApplied("some warning\n"+AppliedMarker+"\n"), "the report after other output")
-
-	assert.Error(t, checkApplied(""), "a run that printed nothing did not apply the change")
-	assert.Error(t, checkApplied("dyld: library not loaded\n"), "output that is not the report")
-}
-
-// A panic out of the FFI layer has to reach the caller as "no mechanism", which is
-// the outcome that offers the user the command instead of taking the window down.
-func TestGuardTurnsAPanicIntoUnavailable(t *testing.T) {
-	err := guard("pretending to call something", func() error {
-		panic("purego: signature it cannot map")
-	})
-
-	require.ErrorIs(t, err, ErrUnavailable, "a panic must read as a missing mechanism")
-	assert.Contains(t, err.Error(), "pretending to call something", "what panicked")
-}
-
-// guard wraps every darwin path, so what a caller switches on has to survive it.
-func TestGuardPassesErrorsThrough(t *testing.T) {
-	sentinel := errors.New("the call itself failed")
-	assert.ErrorIs(t, guard("calling", func() error { return sentinel }), sentinel,
-		"the error it was given")
-	assert.ErrorIs(t, guard("calling", func() error { return ErrDeclined }), ErrDeclined,
-		"a declined prompt stays declined")
-	assert.NoError(t, guard("calling", func() error { return nil }), "a call that worked")
-}

client/internal/elevate/run_unix.go

@@ -1,117 +0,0 @@
-//go:build linux
-
-package elevate
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"strings"
-)
-
-// pkexec exit codes that are about the authorization rather than about the program
-// we asked it to run. The manual page reserves both.
-const (
-	// exitDismissed is returned when the user dismissed the authentication
-	// dialog.
-	exitDismissed = 126
-	// exitNotAuthorized is returned when the authorization was not obtained. That
-	// covers the user saying no as well as pkexec having had nobody to ask: see
-	// noAgentMarkers.
-	exitNotAuthorized = 127
-)
-
-// exitNotAuthorized covers three different endings that only pkexec's own words
-// tell apart, so they are matched here. Read with LC_ALL=C so the words are the
-// ones written below.
-//
-// refusedMarker is a refusal: the user said no, gave up on the password, or holds
-// an account that may not elevate at all.
-const refusedMarker = "Not authorized"
-
-// noAgentMarkers say pkexec had no way to ask: no agent registered for the
-// session, and no controlling terminal for the textual agent it falls back to.
-var noAgentMarkers = []string{"authentication agent", "controlling terminal"}
-
-// run asks polkit to run self as root. pkexec hands the request to the session's
-// polkit agent, which is what prompts and what collects any password; we see only
-// its verdict.
-//
-// The environment is otherwise deliberately not passed through: pkexec clears it
-// bar a small allowlist, and the one-shot needs nothing from it.
-func run(ctx context.Context, self string, args []string) error {
-	pkexec, err := exec.LookPath("pkexec")
-	if err != nil {
-		return fmt.Errorf("%w: pkexec is not installed", ErrUnavailable)
-	}
-
-	cmd := exec.CommandContext(ctx, pkexec, append([]string{self}, args...)...)
-	// C locale so pkexec's own diagnostics are the ones noAgentMarkers knows.
-	cmd.Env = append(os.Environ(), "LC_ALL=C")
-	var stderr strings.Builder
-	cmd.Stderr = &stderr
-	// The one-shot reports itself on stdout for macOS's sake, where there is no
-	// exit status to read. Here there is one, so that line is noise.
-	cmd.Stdout = io.Discard
-
-	err = cmd.Run()
-	if err == nil {
-		return nil
-	}
-
-	var exitErr *exec.ExitError
-	if !errors.As(err, &exitErr) {
-		return fmt.Errorf("run pkexec: %w", err)
-	}
-
-	// Matched against everything pkexec said, reported as one line: a complaint
-	// that is not the first thing printed still has to be recognised, and reading
-	// it as a refusal would swallow it.
-	full := stderr.String()
-	out := firstLine(full)
-
-	switch exitErr.ExitCode() {
-	case exitDismissed:
-		return ErrDeclined
-	case exitNotAuthorized:
-		return notAuthorized(full, out)
-	default:
-		return fmt.Errorf("elevated netbird exited with %d: %s", exitErr.ExitCode(), out)
-	}
-}
-
-// notAuthorized sorts out the three endings pkexec reports as exitNotAuthorized.
-//
-// It also returns that code when the authorization succeeded and it then could
-// not run the program, so a refusal has to be recognised rather than assumed:
-// reading every one of these as "the user said no" would revert the control in
-// silence on a host where elevation is broken.
-func notAuthorized(full, out string) error {
-	switch {
-	case hasAny(full, noAgentMarkers):
-		return fmt.Errorf("%w: polkit had no way to ask: %s", ErrUnavailable, out)
-	case out == noOutput, strings.Contains(full, refusedMarker):
-		// The user said no, which needs no message; that an account barred from
-		// elevating altogether lands here too is why the reason is kept.
-		return fmt.Errorf("%w: %s", ErrDeclined, out)
-	default:
-		return fmt.Errorf("pkexec could not run elevated netbird: %s", out)
-	}
-}
-
-func hasAny(s string, markers []string) bool {
-	for _, marker := range markers {
-		if strings.Contains(s, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func mechanismAvailable() bool {
-	_, err := exec.LookPath("pkexec")
-	return err == nil
-}

client/internal/elevate/run_unix_test.go

@@ -1,110 +0,0 @@
-//go:build linux
-
-package elevate
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// fakePkexec puts a pkexec on PATH that exits with the given code, so the
-// mapping from polkit's exit codes onto our errors can be exercised without a
-// polkit agent.
-func fakePkexec(t *testing.T, exitCode int, stderr string) {
-	t.Helper()
-
-	dir := t.TempDir()
-	script := fmt.Sprintf("#!/bin/sh\necho %s >&2\nexit %d\n", shellQuote(stderr), exitCode)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "pkexec"), []byte(script), 0o700), "write the fake pkexec")
-	t.Setenv("PATH", dir)
-}
-
-func shellQuote(s string) string {
-	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
-}
-
-func TestRunMapsPkexecExitCodes(t *testing.T) {
-	tests := []struct {
-		name     string
-		exitCode int
-		stderr   string
-		wantErr  error
-	}{
-		{name: "applied", exitCode: 0},
-		{
-			name:     "dialog dismissed",
-			exitCode: exitDismissed,
-			stderr:   "Error executing command as another user: Request dismissed",
-			wantErr:  ErrDeclined,
-		},
-		{
-			// What a graphical agent reports for a cancelled prompt. Not a
-			// failure: the user was asked and answered.
-			name:     "prompt cancelled",
-			exitCode: exitNotAuthorized,
-			stderr:   "Error executing command as another user: Not authorized",
-			wantErr:  ErrDeclined,
-		},
-		{
-			// The same status, but pkexec never got to ask anybody.
-			name:     "no agent and no terminal to fall back on",
-			exitCode: exitNotAuthorized,
-			stderr:   "Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address",
-			wantErr:  ErrUnavailable,
-		},
-		{
-			// And the same status again once the authorization succeeded and
-			// pkexec could not run what it had been authorized to run. Reading
-			// that as a refusal would revert the control in silence on a host
-			// where elevation is broken.
-			name:     "authorized but not runnable",
-			exitCode: exitNotAuthorized,
-			stderr:   "Error executing command as another user: No such file or directory",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakePkexec(t, tt.exitCode, tt.stderr)
-
-			err := run(context.Background(), "/nonexistent/netbird-ui", []string{"--flag"})
-			switch {
-			case tt.wantErr != nil:
-				require.ErrorIs(t, err, tt.wantErr, "exit %d said %q", tt.exitCode, tt.stderr)
-			case tt.exitCode == 0:
-				require.NoError(t, err, "a pkexec that exited cleanly applied the change")
-			default:
-				require.Error(t, err, "exit %d said %q", tt.exitCode, tt.stderr)
-				assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
-				assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
-			}
-		})
-	}
-}
-
-// An exit code that is not polkit's is the one-shot's own failure, and has to
-// stay distinguishable from a declined prompt: the caller reports it.
-func TestRunReportsOneShotFailure(t *testing.T) {
-	fakePkexec(t, 3, "the one-shot said no")
-
-	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
-
-	require.Error(t, err, "a one-shot that failed is not a prompt that was answered")
-	assert.NotErrorIs(t, err, ErrDeclined, "not the user's answer")
-	assert.NotErrorIs(t, err, ErrUnavailable, "not a missing mechanism")
-}
-
-func TestRunWithoutPkexecIsUnavailable(t *testing.T) {
-	t.Setenv("PATH", t.TempDir())
-
-	err := run(context.Background(), "/nonexistent/netbird-ui", nil)
-	require.ErrorIs(t, err, ErrUnavailable, "no pkexec means no mechanism")
-	assert.False(t, mechanismAvailable(), "mechanismAvailable without pkexec on PATH")
-}

client/internal/elevate/run_unsupported.go

@@ -1,19 +0,0 @@
-//go:build !windows && !darwin && !linux
-
-package elevate
-
-import "context"
-
-// run reports that this platform has no elevation prompt to drive.
-//
-// The desktop app is the only caller and is not built for any of these: mobile
-// and WASM have no local user to ask, and the FreeBSD client ships without a UI.
-// pkexec would be the mechanism there, and run_unix.go is what to widen if that
-// changes.
-func run(context.Context, string, []string) error {
-	return ErrUnavailable
-}
-
-func mechanismAvailable() bool {
-	return false
-}

client/internal/elevate/run_windows.go

@@ -1,193 +0,0 @@
-package elevate
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"runtime"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-const (
-	// seeMaskNoCloseProcess keeps the started process's handle open in
-	// hProcess so we can wait for it.
-	seeMaskNoCloseProcess = 0x00000040
-	// seeMaskNoAsync makes ShellExecuteExW finish its work before returning,
-	// which it must when the calling thread does not pump messages.
-	seeMaskNoAsync = 0x00000100
-	// seeMaskFlagNoUI suppresses the shell's own error dialogs; the UAC consent
-	// dialog is not one of them and still appears.
-	seeMaskFlagNoUI = 0x00000400
-
-	// swHide: the one-shot has no window to show.
-	swHide = 0
-
-	// sFalse (S_FALSE) answers CoInitializeEx when COM is already up on this
-	// thread in the mode we asked for; rpcChangedMode (RPC_E_CHANGED_MODE) when
-	// it is up in the other one.
-	sFalse         = 1
-	rpcChangedMode = 0x80010106
-)
-
-// shellExecuteInfoW mirrors SHELLEXECUTEINFOW. The field order and Go's own
-// padding match the C layout on both 386 and amd64.
-type shellExecuteInfoW struct {
-	cbSize         uint32
-	fMask          uint32
-	hwnd           windows.HWND
-	lpVerb         *uint16
-	lpFile         *uint16
-	lpParameters   *uint16
-	lpDirectory    *uint16
-	nShow          int32
-	hInstApp       windows.Handle
-	lpIDList       uintptr
-	lpClass        *uint16
-	hkeyClass      windows.Handle
-	dwHotKey       uint32
-	hIconOrMonitor windows.Handle
-	hProcess       windows.Handle
-}
-
-var (
-	shell32            = windows.NewLazySystemDLL("shell32.dll")
-	procShellExecuteEx = shell32.NewProc("ShellExecuteExW")
-)
-
-// run starts self elevated with the "runas" verb, which is what raises the UAC
-// consent dialog, and waits for it to finish. Windows decides whether consent is
-// enough or an administrator's credentials are needed, and collects them itself.
-func run(ctx context.Context, self string, args []string) error {
-	verb, err := windows.UTF16PtrFromString("runas")
-	if err != nil {
-		return fmt.Errorf("encode verb: %w", err)
-	}
-	file, err := windows.UTF16PtrFromString(self)
-	if err != nil {
-		return fmt.Errorf("encode %s: %w", self, err)
-	}
-	params, err := windows.UTF16PtrFromString(windows.ComposeCommandLine(args))
-	if err != nil {
-		return fmt.Errorf("encode arguments: %w", err)
-	}
-
-	info := shellExecuteInfoW{
-		fMask:        seeMaskNoCloseProcess | seeMaskNoAsync | seeMaskFlagNoUI,
-		hwnd:         ownerWindow(),
-		lpVerb:       verb,
-		lpFile:       file,
-		lpParameters: params,
-		nShow:        swHide,
-	}
-	info.cbSize = uint32(unsafe.Sizeof(info))
-
-	process, err := shellExecute(&info)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err := windows.CloseHandle(process); err != nil {
-			log.Debugf("close elevated process handle: %v", err)
-		}
-	}()
-
-	return waitForProcess(ctx, process)
-}
-
-// shellExecute performs the call itself. ShellExecuteExW wants COM initialised on
-// the calling thread, so the goroutine is pinned to one for the duration and COM
-// is set up on it; an "already initialised, different mode" answer is fine,
-// because then somebody else has done it for us.
-func shellExecute(info *shellExecuteInfoW) (windows.Handle, error) {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	switch err := windows.CoInitializeEx(0, windows.COINIT_APARTMENTTHREADED); {
-	case err == nil, isHResult(err, sFalse):
-		// Ours, or already initialised in the same mode: either way this call
-		// counts and has to be balanced.
-		defer windows.CoUninitialize()
-	case isHResult(err, rpcChangedMode):
-		// The thread is already in the other apartment model. ShellExecuteExW
-		// works there too, and there is nothing of ours to balance.
-	default:
-		return 0, fmt.Errorf("initialise COM: %w", err)
-	}
-
-	ret, _, lastErr := procShellExecuteEx.Call(uintptr(unsafe.Pointer(info)))
-	if ret != 0 {
-		return info.hProcess, nil
-	}
-
-	if errors.Is(lastErr, windows.ERROR_CANCELLED) {
-		return 0, ErrDeclined
-	}
-	return 0, fmt.Errorf("run elevated: %w", lastErr)
-}
-
-// ownerWindow returns this process's foreground window, and 0 when the window in
-// front belongs to somebody else or cannot be attributed. ShellExecuteExW takes it
-// as the parent for the UI it raises, which is what keeps the consent dialog in
-// front of the window the user was just clicking in instead of behind it. It is
-// also what a remote-desktop session needs to place the dialog at all when the
-// secure desktop is switched off.
-func ownerWindow() windows.HWND {
-	hwnd := windows.GetForegroundWindow()
-	if hwnd == 0 {
-		return 0
-	}
-
-	var pid uint32
-	if _, err := windows.GetWindowThreadProcessId(hwnd, &pid); err != nil {
-		log.Debugf("cannot attribute the foreground window, raising the prompt without an owner: %v", err)
-		return 0
-	}
-	if pid != windows.GetCurrentProcessId() {
-		return 0
-	}
-	return hwnd
-}
-
-// isHResult reports whether err carries the given HRESULT. CoInitializeEx
-// returns its HRESULT as an Errno, so the comparison is on the raw value.
-func isHResult(err error, hresult uintptr) bool {
-	var errno windows.Errno
-	return errors.As(err, &errno) && uintptr(errno) == hresult
-}
-
-func waitForProcess(ctx context.Context, process windows.Handle) error {
-	// The wait is interruptible so a cancelled context stops us waiting on a
-	// consent dialog nobody is going to answer. The elevated process is not
-	// ours to kill, and it either applies the change or does not.
-	for {
-		event, err := windows.WaitForSingleObject(process, 250)
-		if err != nil {
-			return fmt.Errorf("wait for the elevated process: %w", err)
-		}
-		if event == uint32(windows.WAIT_OBJECT_0) {
-			break
-		}
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-	}
-
-	var code uint32
-	if err := windows.GetExitCodeProcess(process, &code); err != nil {
-		return fmt.Errorf("read the elevated process's exit code: %w", err)
-	}
-	if code != 0 {
-		return fmt.Errorf("elevated netbird exited with %d", code)
-	}
-	return nil
-}
-
-// mechanismAvailable is true on Windows: UAC prompts for consent when the user
-// is an administrator and for an administrator's credentials when they are not,
-// so there is always something to ask.
-func mechanismAvailable() bool {
-	return true
-}

client/internal/elevate/trusted.go

@@ -1,40 +0,0 @@
-package elevate
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// trustedSelf returns the path of this executable, provided it is one we are
-// willing to have run as root.
-//
-// The check is what keeps elevation from becoming a way to launder someone
-// else's code into a root process: the user consents to NetBird being elevated,
-// having been shown NetBird's name, so what runs must be the file NetBird was
-// installed as and not something a third party could have swapped for it. An
-// executable only its owner can write is that; anything wider is refused, and
-// the caller falls back to showing the command instead.
-//
-// The owner writing to their own executable is not part of that threat: code
-// running as the user can already prompt them for anything, and could just as
-// well ask them to run the command by hand. What matters is that no *other*
-// unprivileged account can reach it.
-func trustedSelf() (string, error) {
-	exe, err := os.Executable()
-	if err != nil {
-		return "", fmt.Errorf("locate this executable: %w", err)
-	}
-
-	// Resolve symlinks so the checks below apply to the file that would actually
-	// be executed, not to a link somebody else may control.
-	resolved, err := filepath.EvalSymlinks(exe)
-	if err != nil {
-		return "", fmt.Errorf("resolve %s: %w", exe, err)
-	}
-
-	if err := checkOnlyOwnerWritable(resolved); err != nil {
-		return "", fmt.Errorf("%w: %s cannot be trusted to run as root: %w", ErrUnavailable, resolved, err)
-	}
-	return resolved, nil
-}

client/internal/elevate/trusted_group_darwin.go

@@ -1,10 +0,0 @@
-package elevate
-
-// adminWriteGIDs are the groups whose write access to an executable does not
-// widen who could authorize elevating it.
-//
-// macOS installs applications as root:admin, mode 0775, /Applications included,
-// so requiring owner-only write would reject every normal install. Group admin
-// (gid 80) is exactly the set of accounts that can answer the authentication
-// dialog, so its write access grants nothing the prompt would not.
-var adminWriteGIDs = []uint32{0, 80}

client/internal/elevate/trusted_group_unix.go

@@ -1,9 +0,0 @@
-//go:build !windows && !darwin
-
-package elevate
-
-// adminWriteGIDs are the groups whose write access to an executable does not
-// widen who could authorize elevating it. Only root's own group qualifies here:
-// a distribution installs into root-owned directories, and there is no
-// system-wide administrators group that both writes them and answers polkit.
-var adminWriteGIDs = []uint32{0}

client/internal/elevate/trusted_unix.go

@@ -1,146 +0,0 @@
-//go:build !windows
-
-package elevate
-
-import (
-	"bufio"
-	"errors"
-	"fmt"
-	"os"
-	"os/user"
-	"path/filepath"
-	"slices"
-	"strconv"
-	"strings"
-	"syscall"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// groupFile lists which accounts are in which group, for the membership a user
-// private group's name does not state: see groupHasOtherMembers.
-const groupFile = "/etc/group"
-
-// checkOnlyOwnerWritable reports an error unless path, and every directory leading
-// to it, is owned by either root or this user and writable by nobody who could not
-// already act as its owner. A writable directory is as good as a writable file,
-// since anything in it can be replaced, so the whole chain is checked.
-func checkOnlyOwnerWritable(path string) error {
-	self := uint32(os.Getuid())
-
-	for dir := path; ; dir = filepath.Dir(dir) {
-		info, err := os.Lstat(dir)
-		if err != nil {
-			return fmt.Errorf("stat %s: %w", dir, err)
-		}
-
-		stat, ok := info.Sys().(*syscall.Stat_t)
-		if !ok {
-			return errors.New("file ownership is unavailable on this platform")
-		}
-		if stat.Uid != 0 && stat.Uid != self {
-			return fmt.Errorf("%s is owned by uid %d, neither root nor this user", dir, stat.Uid)
-		}
-
-		if err := checkWriteBits(dir, info, stat.Uid, stat.Gid); err != nil {
-			return err
-		}
-
-		if parent := filepath.Dir(dir); parent == dir {
-			return nil
-		}
-	}
-}
-
-func checkWriteBits(path string, info os.FileInfo, uid, gid uint32) error {
-	// On a directory the sticky bit stands in for the write bits: whoever may
-	// write there still cannot replace an entry they do not own, which is the
-	// only thing that would matter to us. /tmp is the usual example.
-	sticky := info.IsDir() && info.Mode()&os.ModeSticky != 0
-
-	return writeBitsAllow(path, info.Mode().Perm(), sticky, groupWriteAllowed(uid, gid))
-}
-
-// writeBitsAllow decides on the permission bits alone, given whether the group's
-// write access has been vouched for.
-func writeBitsAllow(path string, perm os.FileMode, sticky, groupAllowed bool) error {
-	if sticky {
-		return nil
-	}
-	if perm&0o020 != 0 && !groupAllowed {
-		return fmt.Errorf("%s is writable by a group with members other than its owner (%v)", path, perm)
-	}
-	if perm&0o002 != 0 {
-		return fmt.Errorf("%s is world-writable (%v)", path, perm)
-	}
-	return nil
-}
-
-// groupWriteAllowed reports whether a group's write access to a file owned by uid
-// puts it in reach of anyone who could not already act as that owner.
-//
-// Two ways it does not. A group in adminWriteGIDs holds the accounts that can
-// answer the elevation prompt anyway. And a user private group is how Debian,
-// Ubuntu and Fedora ship: their umask of 002 makes a home directory and
-// everything built in it group-writable, so refusing that would refuse every
-// build not installed from a package.
-func groupWriteAllowed(uid, gid uint32) bool {
-	if slices.Contains(adminWriteGIDs, gid) {
-		return true
-	}
-
-	group, err := user.LookupGroupId(strconv.FormatUint(uint64(gid), 10))
-	if err != nil {
-		log.Debugf("cannot look up group %d, treating it as shared: %v", gid, err)
-		return false
-	}
-	owner, err := user.LookupId(strconv.FormatUint(uint64(uid), 10))
-	if err != nil {
-		log.Debugf("cannot look up uid %d, treating its group as shared: %v", uid, err)
-		return false
-	}
-
-	if group.Name != owner.Username {
-		return false
-	}
-	return !groupHasOtherMembers(groupFile, group.Name, owner.Username)
-}
-
-// groupHasOtherMembers reports whether the group lists a member besides owner.
-//
-// Sharing the owner's name is what a user private group is recognised by, and it
-// says nothing about who is in it: a group that has since gained a member is
-// still named that way, and that member can write whatever the group can. So the
-// membership is read rather than assumed. A group this file does not describe,
-// because it comes from LDAP or another NSS source, cannot be answered here and
-// leaves the name as the only thing to go on.
-func groupHasOtherMembers(path, name, owner string) bool {
-	file, err := os.Open(path)
-	if err != nil {
-		log.Debugf("cannot read %s for the members of group %q: %v", path, name, err)
-		return false
-	}
-	defer func() {
-		if err := file.Close(); err != nil {
-			log.Debugf("close %s: %v", path, err)
-		}
-	}()
-
-	scanner := bufio.NewScanner(file)
-	for scanner.Scan() {
-		// name:password:gid:member,member
-		fields := strings.Split(scanner.Text(), ":")
-		if len(fields) < 4 || fields[0] != name {
-			continue
-		}
-		for member := range strings.SplitSeq(fields[3], ",") {
-			if member != "" && member != owner {
-				return true
-			}
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		log.Debugf("read %s: %v", path, err)
-	}
-	return false
-}

client/internal/elevate/trusted_unix_test.go

@@ -1,177 +0,0 @@
-//go:build !windows
-
-package elevate
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// ownerOnlyDir is t.TempDir() with the write bits tightened. testing creates its
-// numbered directory with 0777 minus the umask, so under the common 002 umask it
-// is group-writable and would fail the check under test on its own.
-func ownerOnlyDir(t *testing.T) string {
-	t.Helper()
-	dir := t.TempDir()
-	require.NoError(t, os.Chmod(dir, 0o755), "tighten the temporary directory")
-	return dir
-}
-
-// writeExecutable creates a plain executable file, the shape trustedSelf checks.
-func writeExecutable(t *testing.T, dir string) string {
-	t.Helper()
-	path := filepath.Join(dir, "netbird-ui")
-	require.NoError(t, os.WriteFile(path, []byte("#!/bin/sh\n"), 0o755), "write the executable")
-	require.NoError(t, os.Chmod(path, 0o755), "set the executable's mode")
-	return path
-}
-
-func TestCheckOnlyOwnerWritableAcceptsOwnerOnly(t *testing.T) {
-	err := checkOnlyOwnerWritable(writeExecutable(t, ownerOnlyDir(t)))
-	assert.NoError(t, err, "an owner-only writable executable is trustworthy")
-}
-
-func TestCheckOnlyOwnerWritableRejectsWorldWritableFile(t *testing.T) {
-	path := writeExecutable(t, ownerOnlyDir(t))
-	require.NoError(t, os.Chmod(path, 0o777), "make the executable world-writable")
-
-	assert.Error(t, checkOnlyOwnerWritable(path), "a world-writable executable must be refused")
-}
-
-// The permission policy on its own, without a filesystem to arrange: whether the
-// group has been vouched for is the only thing that makes group write acceptable.
-func TestWriteBitsAllow(t *testing.T) {
-	tests := []struct {
-		name         string
-		perm         os.FileMode
-		sticky       bool
-		groupAllowed bool
-		wantErr      bool
-	}{
-		{name: "owner only", perm: 0o755},
-		{name: "group write in a private group", perm: 0o775, groupAllowed: true},
-		{name: "group write in a shared group", perm: 0o775, wantErr: true},
-		{name: "world write", perm: 0o777, groupAllowed: true, wantErr: true},
-		{name: "world write on a sticky directory", perm: 0o777, sticky: true},
-		{name: "group write on a sticky directory", perm: 0o775, sticky: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := writeBitsAllow("/path", tt.perm, tt.sticky, tt.groupAllowed)
-			if tt.wantErr {
-				assert.Error(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
-				return
-			}
-			assert.NoError(t, err, "perm %v, sticky %v, group allowed %v", tt.perm, tt.sticky, tt.groupAllowed)
-		})
-	}
-}
-
-// A build under a home directory on a distribution with a 002 umask, which is what
-// a locally built or tarball-installed binary looks like. Its group has no members
-// but its owner, so it is as good as owner-only.
-//
-// Whether this host is such a distribution is read from the environment rather than
-// from groupWriteAllowed: asking the function under test whether to run would let
-// it skip its own coverage away if it regressed to refusing everything.
-func TestCheckOnlyOwnerWritableAcceptsOwnPrivateGroup(t *testing.T) {
-	requirePrivatePrimaryGroup(t)
-
-	dir := ownerOnlyDir(t)
-	path := writeExecutable(t, dir)
-	require.NoError(t, os.Chmod(dir, 0o775), "make the directory group-writable")
-	require.NoError(t, os.Chmod(path, 0o775), "make the executable group-writable")
-
-	err := checkOnlyOwnerWritable(path)
-	assert.NoError(t, err, "group write in the owner's own private group reaches nobody else")
-}
-
-// A group that shares its owner's name but has gained another member is no longer
-// private, and its write access reaches an account that could not elevate.
-func TestGroupHasOtherMembers(t *testing.T) {
-	tests := []struct {
-		name  string
-		entry string
-		want  bool
-	}{
-		{name: "no members", entry: "vma:x:1000:"},
-		{name: "only the owner", entry: "vma:x:1000:vma"},
-		{name: "another member", entry: "vma:x:1000:bob", want: true},
-		{name: "the owner and another", entry: "vma:x:1000:vma,bob", want: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			path := filepath.Join(t.TempDir(), "group")
-			body := "root:x:0:\n" + tt.entry + "\nsudo:x:27:vma\n"
-			require.NoError(t, os.WriteFile(path, []byte(body), 0o644), "write the group file")
-
-			assert.Equal(t, tt.want, groupHasOtherMembers(path, "vma", "vma"), "entry %q", tt.entry)
-		})
-	}
-}
-
-// A group file that says nothing about the group leaves the name as the only thing
-// to go on, so the private-group allowance stands rather than collapsing on every
-// host whose groups come from LDAP.
-func TestGroupHasOtherMembersTolerantOfAnUnknownGroup(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "group")
-	require.NoError(t, os.WriteFile(path, []byte("root:x:0:\n"), 0o644), "write the group file")
-
-	assert.False(t, groupHasOtherMembers(path, "vma", "vma"), "a group the file does not describe")
-	assert.False(t, groupHasOtherMembers(filepath.Join(t.TempDir(), "absent"), "vma", "vma"),
-		"no group file at all")
-}
-
-// A writable directory is as good as a writable file: whoever can write the
-// directory can put a different binary at the same path.
-func TestCheckOnlyOwnerWritableRejectsWritableDirectory(t *testing.T) {
-	dir := filepath.Join(ownerOnlyDir(t), "bin")
-	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
-	path := writeExecutable(t, dir)
-	require.NoError(t, os.Chmod(dir, 0o777), "make the directory world-writable")
-
-	assert.Error(t, checkOnlyOwnerWritable(path), "an executable in a world-writable directory must be refused")
-}
-
-// A sticky world-writable directory is exempt: the sticky bit is what stops one
-// user replacing another's entries. /tmp is why this matters.
-func TestCheckOnlyOwnerWritableAcceptsStickyDirectory(t *testing.T) {
-	dir := filepath.Join(ownerOnlyDir(t), "sticky")
-	require.NoError(t, os.Mkdir(dir, 0o755), "create the directory")
-	path := writeExecutable(t, dir)
-	require.NoError(t, os.Chmod(dir, 0o777|os.ModeSticky), "make the directory sticky and world-writable")
-
-	err := checkOnlyOwnerWritable(path)
-	assert.NoError(t, err, "the sticky bit stops another user replacing the executable")
-}
-
-func TestCheckOnlyOwnerWritableRejectsMissingFile(t *testing.T) {
-	err := checkOnlyOwnerWritable(filepath.Join(ownerOnlyDir(t), "absent"))
-	assert.Error(t, err, "an executable that is not there must be refused")
-}
-
-// requirePrivatePrimaryGroup skips unless this user's primary group is their own,
-// which is what the user-private-group allowance is about.
-func requirePrivatePrimaryGroup(t *testing.T) {
-	t.Helper()
-
-	self, err := user.Current()
-	require.NoError(t, err, "look up the test user")
-	group, err := user.LookupGroupId(strconv.Itoa(os.Getgid()))
-	require.NoError(t, err, "look up the test user's primary group")
-
-	if group.Name != self.Username {
-		t.Skipf("the test user's primary group is %q, not their own, so there is nothing to assert here", group.Name)
-	}
-	if groupHasOtherMembers(groupFile, group.Name, self.Username) {
-		t.Skipf("group %q has other members, so it is not a private group", group.Name)
-	}
-}

client/internal/elevate/trusted_windows.go

@@ -1,215 +0,0 @@
-package elevate
-
-import (
-	"errors"
-	"fmt"
-	"path/filepath"
-	"slices"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-const (
-	// fileDeleteChild is FILE_DELETE_CHILD, which x/sys does not define: the
-	// right to delete an entry of a directory without holding DELETE on it.
-	fileDeleteChild = 0x00000040
-
-	// accessAllowedCallbackACEType is an allow ACE with a condition appended to
-	// the ACCESS_ALLOWED_ACE layout, so its trustee is still at SidStart.
-	accessAllowedCallbackACEType = 0x9
-
-	// The allow ACE types that carry object GUIDs ahead of the trustee, so the
-	// SID is not at SidStart. They occur on directory-service objects rather
-	// than files, and are refused rather than skipped: see aceTrustee.
-	accessAllowedObjectACEType         = 0x5
-	accessAllowedCallbackObjectACEType = 0xB
-)
-
-// fileWriteAccess are the rights that let a trustee rewrite or replace a file,
-// or take it over and then do so.
-const fileWriteAccess = windows.FILE_WRITE_DATA | windows.FILE_APPEND_DATA |
-	windows.DELETE | windows.WRITE_DAC | windows.WRITE_OWNER |
-	windows.GENERIC_WRITE | windows.GENERIC_ALL
-
-// dirWriteAccess are the rights over a directory that let a trustee replace an
-// entry somebody else owns. Creating a new entry is not one of them, which is
-// what the Unix sticky bit says in one bit: the root of every volume grants
-// BUILTIN\Users the right to add directories under it, and that reaches nothing
-// already there.
-const dirWriteAccess = fileDeleteChild | windows.DELETE |
-	windows.WRITE_DAC | windows.WRITE_OWNER | windows.GENERIC_ALL
-
-// trustedInstallerSID owns much of what Windows itself installs. x/sys has no
-// well-known constant for it.
-const trustedInstallerSID = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
-
-// checkOnlyOwnerWritable reports an error unless path, and every directory
-// leading to it, is owned by an account that can elevate (or by this user) and
-// grants write access to nobody else. A writable directory is as good as a
-// writable file, since an entry in it can be replaced, so the whole chain is
-// checked.
-func checkOnlyOwnerWritable(path string) error {
-	owners, err := trustedOwners()
-	if err != nil {
-		return err
-	}
-	writers, err := trustedWriters(owners)
-	if err != nil {
-		return err
-	}
-
-	writeAccess := windows.ACCESS_MASK(fileWriteAccess)
-	for target := path; ; target = filepath.Dir(target) {
-		if err := checkSecurity(target, writeAccess, owners, writers); err != nil {
-			return err
-		}
-		if parent := filepath.Dir(target); parent == target {
-			return nil
-		}
-		writeAccess = dirWriteAccess
-	}
-}
-
-// trustedOwners are the accounts we accept as the owner of the executable and of
-// the directories above it: the ones that can already answer the UAC prompt,
-// plus this user, whose own executable is theirs to write. Code running as the
-// user could prompt them for anything anyway; what matters is that no *other*
-// unprivileged account can reach it.
-func trustedOwners() ([]*windows.SID, error) {
-	self, err := currentUserSID()
-	if err != nil {
-		return nil, err
-	}
-
-	owners := []*windows.SID{self}
-	for _, wellKnown := range []windows.WELL_KNOWN_SID_TYPE{
-		windows.WinLocalSystemSid,
-		windows.WinBuiltinAdministratorsSid,
-	} {
-		sid, err := windows.CreateWellKnownSid(wellKnown)
-		if err != nil {
-			return nil, fmt.Errorf("build well-known SID %d: %w", wellKnown, err)
-		}
-		owners = append(owners, sid)
-	}
-
-	installer, err := windows.StringToSid(trustedInstallerSID)
-	if err != nil {
-		return nil, fmt.Errorf("parse TrustedInstaller SID: %w", err)
-	}
-	return append(owners, installer), nil
-}
-
-// trustedWriters are the trustees whose write access does not widen who could
-// decide what runs behind the prompt. The owners, and CREATOR OWNER, which
-// resolves to the object's owner and is therefore already vetted.
-func trustedWriters(owners []*windows.SID) ([]*windows.SID, error) {
-	creatorOwner, err := windows.CreateWellKnownSid(windows.WinCreatorOwnerSid)
-	if err != nil {
-		return nil, fmt.Errorf("build the CREATOR OWNER SID: %w", err)
-	}
-	return append(slices.Clone(owners), creatorOwner), nil
-}
-
-func checkSecurity(path string, writeAccess windows.ACCESS_MASK, owners, writers []*windows.SID) error {
-	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
-		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
-	if err != nil {
-		return fmt.Errorf("read security descriptor of %s: %w", path, err)
-	}
-
-	owner, _, err := sd.Owner()
-	if err != nil {
-		return fmt.Errorf("read owner of %s: %w", path, err)
-	}
-	if !containsSID(owners, owner) {
-		return fmt.Errorf("%s is owned by %s, which is neither this user nor an account that can elevate", path, owner)
-	}
-
-	dacl, _, err := sd.DACL()
-	if err != nil {
-		return fmt.Errorf("read DACL of %s: %w", path, err)
-	}
-	// A NULL DACL grants everyone everything; only an absent security
-	// descriptor would have got us here without one, and neither is trustworthy.
-	if dacl == nil {
-		return fmt.Errorf("%s has no DACL, so it grants write access to everyone", path)
-	}
-
-	return checkDACL(path, dacl, writeAccess, writers)
-}
-
-// checkDACL refuses an ACL that grants write access to a trustee outside
-// writers.
-//
-// An allowlist, because the trustees that must not have it cannot be listed: an
-// ACE naming an ordinary user account hands that account the same power as one
-// naming Everyone, and only the accounts that may hold it are knowable.
-func checkDACL(path string, dacl *windows.ACL, writeAccess windows.ACCESS_MASK, writers []*windows.SID) error {
-	for i := uint32(0); i < uint32(dacl.AceCount); i++ {
-		var ace *windows.ACCESS_ALLOWED_ACE
-		if err := windows.GetAce(dacl, i, &ace); err != nil {
-			return fmt.Errorf("read ACE %d of %s: %w", i, path, err)
-		}
-		// An inherit-only ACE says what children of this object get, not what
-		// this object grants.
-		if ace.Header.AceFlags&windows.INHERIT_ONLY_ACE != 0 {
-			continue
-		}
-		if ace.Mask&writeAccess == 0 {
-			continue
-		}
-		// Only an allow ACE grants anything; a deny ACE narrows what one gave.
-		if !isAllowACE(ace.Header.AceType) {
-			continue
-		}
-
-		trustee, err := aceTrustee(ace)
-		if err != nil {
-			return fmt.Errorf("read the trustee of ACE %d of %s: %w", i, path, err)
-		}
-		if !containsSID(writers, trustee) {
-			return fmt.Errorf("%s grants write access to %s", path, trustee)
-		}
-	}
-	return nil
-}
-
-// isAllowACE reports whether an ACE type grants rights, rather than denying,
-// auditing or labelling them.
-func isAllowACE(aceType uint8) bool {
-	switch aceType {
-	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType,
-		accessAllowedObjectACEType, accessAllowedCallbackObjectACEType:
-		return true
-	default:
-		return false
-	}
-}
-
-// aceTrustee returns who an allow ACE grants its rights to. An ACE whose trustee
-// cannot be located is an error rather than something to skip past: being unable
-// to read who is being given write access is a refusal.
-func aceTrustee(ace *windows.ACCESS_ALLOWED_ACE) (*windows.SID, error) {
-	switch ace.Header.AceType {
-	case windows.ACCESS_ALLOWED_ACE_TYPE, accessAllowedCallbackACEType:
-		//nolint:gosec // SidStart is the first uint32 of the variable-length SID that follows the ACE header.
-		return (*windows.SID)(unsafe.Pointer(&ace.SidStart)), nil
-	default:
-		return nil, errors.New("an object-type allow ACE does not carry its trustee where we can read it")
-	}
-}
-
-func containsSID(sids []*windows.SID, sid *windows.SID) bool {
-	return slices.ContainsFunc(sids, sid.Equals)
-}
-
-func currentUserSID() (*windows.SID, error) {
-	token := windows.GetCurrentProcessToken()
-	user, err := token.GetTokenUser()
-	if err != nil {
-		return nil, fmt.Errorf("read this process's user: %w", err)
-	}
-	return user.User.Sid, nil
-}

client/internal/elevate/trusted_windows_test.go

@@ -1,126 +0,0 @@
-package elevate
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// A file the test user created under their own profile, which is what a per-user
-// install looks like. The whole chain up to the volume root is walked, so this is
-// also what says the walk does not refuse an ordinary Windows installation: the
-// root of every volume grants BUILTIN\Users rights that are not ours to worry
-// about.
-func TestCheckOnlyOwnerWritableAcceptsOwnFile(t *testing.T) {
-	err := checkOnlyOwnerWritable(writeExecutable(t))
-	assert.NoError(t, err, "a file the test user owns, under directories only administrators can write")
-}
-
-// Write access held by an account that cannot answer the UAC prompt means that
-// account decides what runs behind it, whoever the ACE names. The trustees that
-// must not have it cannot be listed, so the check names the ones that may.
-func TestCheckOnlyOwnerWritableRejectsUntrustedWriters(t *testing.T) {
-	tests := []struct {
-		name      string
-		wellKnown windows.WELL_KNOWN_SID_TYPE
-	}{
-		{name: "everyone", wellKnown: windows.WinWorldSid},
-		{name: "authenticated users", wellKnown: windows.WinAuthenticatedUserSid},
-		{name: "builtin users", wellKnown: windows.WinBuiltinUsersSid},
-		// A service account, which no denylist of the obvious groups would name
-		// and which cannot elevate any more than Everyone can.
-		{name: "local service", wellKnown: windows.WinLocalServiceSid},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			path := writeExecutable(t)
-			grantWrite(t, path, tt.wellKnown)
-
-			assert.Error(t, checkOnlyOwnerWritable(path),
-				"write access for %s must be refused", tt.name)
-		})
-	}
-}
-
-// The masks are the policy: on a file any write reaches its contents, while on a
-// directory only deleting or taking over an entry reaches something already
-// there. Adding an entry does not, which is why the walk survives a volume root.
-func TestWriteAccessMasks(t *testing.T) {
-	assert.NotZero(t, fileWriteAccess&windows.FILE_WRITE_DATA, "writing a file's data reaches its contents")
-	assert.NotZero(t, fileWriteAccess&windows.FILE_APPEND_DATA, "appending to a file reaches its contents")
-
-	assert.Zero(t, dirWriteAccess&windows.FILE_WRITE_DATA, "adding a file to a directory replaces nothing")
-	assert.Zero(t, dirWriteAccess&windows.FILE_APPEND_DATA, "adding a subdirectory replaces nothing")
-	assert.NotZero(t, dirWriteAccess&fileDeleteChild, "deleting an entry replaces it")
-	assert.NotZero(t, dirWriteAccess&windows.DELETE, "deleting the directory takes its entries with it")
-}
-
-func TestIsAllowACE(t *testing.T) {
-	tests := []struct {
-		name    string
-		aceType uint8
-		want    bool
-	}{
-		{name: "allowed", aceType: windows.ACCESS_ALLOWED_ACE_TYPE, want: true},
-		{name: "allowed callback", aceType: accessAllowedCallbackACEType, want: true},
-		{name: "allowed object", aceType: accessAllowedObjectACEType, want: true},
-		{name: "allowed callback object", aceType: accessAllowedCallbackObjectACEType, want: true},
-		{name: "denied", aceType: windows.ACCESS_DENIED_ACE_TYPE},
-		// SYSTEM_AUDIT_ACE_TYPE, which x/sys does not define: an ACE that records
-		// access rather than granting it.
-		{name: "audit", aceType: 0x2},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, isAllowACE(tt.aceType), "ACE type %#x", tt.aceType)
-		})
-	}
-}
-
-// writeExecutable creates a plain file under the test's own directory, the shape
-// trustedSelf checks.
-func writeExecutable(t *testing.T) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "netbird-ui.exe")
-	require.NoError(t, os.WriteFile(path, []byte("MZ"), 0o755), "write the executable")
-	return path
-}
-
-// grantWrite replaces the file's DACL with one that grants a well-known trustee
-// everything, keeping the test user's own access so the file stays deletable.
-func grantWrite(t *testing.T, path string, wellKnown windows.WELL_KNOWN_SID_TYPE) {
-	t.Helper()
-
-	trustee, err := windows.CreateWellKnownSid(wellKnown)
-	require.NoError(t, err, "build the trustee SID")
-	self, err := currentUserSID()
-	require.NoError(t, err, "read the test user's SID")
-
-	acl, err := windows.ACLFromEntries([]windows.EXPLICIT_ACCESS{
-		fullControl(self, windows.TRUSTEE_IS_USER),
-		fullControl(trustee, windows.TRUSTEE_IS_WELL_KNOWN_GROUP),
-	}, nil)
-	require.NoError(t, err, "build the ACL")
-
-	require.NoError(t, windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
-		windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
-		nil, nil, acl, nil), "set the DACL")
-}
-
-func fullControl(sid *windows.SID, trusteeType uint32) windows.EXPLICIT_ACCESS {
-	return windows.EXPLICIT_ACCESS{
-		AccessPermissions: windows.GENERIC_ALL,
-		AccessMode:        windows.GRANT_ACCESS,
-		Trustee: windows.TRUSTEE{
-			TrusteeForm:  windows.TRUSTEE_IS_SID,
-			TrusteeType:  windows.TRUSTEE_TYPE(trusteeType),
-			TrusteeValue: windows.TrusteeValueFromSID(sid),
-		},
-	}
-}

client/internal/engine.go

@@ -572,7 +572,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 	e.stateManager.Start()
 
-	dnsServer, err := e.newDnsServer()
+	initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings()
+	if err != nil {
+		return fmt.Errorf("read initial settings: %w", err)
+	}
+
+	dnsServer, err := e.newDnsServer(dnsConfig)
 	if err != nil {
 		return fmt.Errorf("create dns server: %w", err)
 	}
@@ -590,8 +595,10 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		WGInterface:         e.wgInterface,
 		StatusRecorder:      e.statusRecorder,
 		RelayManager:        e.relayManager,
+		InitialRoutes:       initialRoutes,
 		StateManager:        e.stateManager,
 		DNSServer:           dnsServer,
+		DNSFeatureFlag:      dnsFeatureFlag,
 		PeerStore:           e.peerStore,
 		DisableClientRoutes: e.config.DisableClientRoutes,
 		DisableServerRoutes: e.config.DisableServerRoutes,
@@ -1067,7 +1074,7 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return err
 	}
 
-	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", "", nil)
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", nil, nil)
 
 	return nil
 }
@@ -2095,6 +2102,42 @@ func (e *Engine) close() {
 	}
 }
 
+func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, error) {
+	if runtime.GOOS != "android" {
+		// nolint:nilnil
+		return nil, nil, false, nil
+	}
+
+	info := system.GetInfo(e.ctx)
+	info.SetFlags(
+		e.config.RosenpassEnabled,
+		e.config.RosenpassPermissive,
+		&e.config.ServerSSHAllowed,
+		e.config.DisableClientRoutes,
+		e.config.DisableServerRoutes,
+		e.config.DisableDNS,
+		e.config.DisableFirewall,
+		e.config.BlockLANAccess,
+		e.config.BlockInbound,
+		e.config.DisableIPv6,
+		e.config.SyncMessageVersion,
+		e.config.EnableSSHRoot,
+		e.config.EnableSSHSFTP,
+		e.config.EnableSSHLocalPortForwarding,
+		e.config.EnableSSHRemotePortForwarding,
+		e.config.DisableSSHAuth,
+	)
+
+	netMap, err := e.mgmClient.GetNetworkMap(info)
+	if err != nil {
+		return nil, nil, false, err
+	}
+	routes := toRoutes(netMap.GetRoutes())
+	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
+	dnsFeatureFlag := toDNSFeatureFlag(netMap)
+	return routes, &dnsCfg, dnsFeatureFlag, nil
+}
+
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
 	transportNet, err := e.newStdNet()
 	if err != nil {
@@ -2129,7 +2172,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
 func (e *Engine) wgInterfaceCreate() (err error) {
 	switch runtime.GOOS {
 	case "android":
-		err = e.wgInterface.CreateOnAndroid(e.routeManager.CurrentRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
+		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
 		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
 		if e.config.WgAddr.HasIPv6() {
@@ -2142,7 +2185,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	return err
 }
 
-func (e *Engine) newDnsServer() (dns.Server, error) {
+func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 	// due to tests where we are using a mocked version of the DNS server
 	if e.dnsServer != nil {
 		return e.dnsServer, nil
@@ -2154,7 +2197,7 @@ func (e *Engine) newDnsServer() (dns.Server, error) {
 			e.ctx,
 			e.wgInterface,
 			e.mobileDep.HostDNSAddresses,
-			nbdns.Config{},
+			*dnsConfig,
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
 			e.config.DisableDNS,

client/internal/engine_authsession.go

@@ -57,7 +57,8 @@ func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_AUTHENTICATION,
 			"session deadline rejected",
-			"",
+			cProto.NewUserMessage(cProto.UserMsgSessionDeadlineReject).
+				WithTitle(cProto.TitleSessionDeadlineReject),
 			map[string]string{sessionwatch.MetaSessionDeadlineRejected: err.Error()},
 		)
 	}

client/internal/engine_tunsettings.go

@@ -1,20 +0,0 @@
-package internal
-
-func (e *Engine) TunSettings() ([]string, []string) {
-	e.syncMsgMux.Lock()
-	routeManager := e.routeManager
-	dnsServer := e.dnsServer
-	e.syncMsgMux.Unlock()
-
-	var routes []string
-	if routeManager != nil {
-		routes = routeManager.CurrentRouteRange()
-	}
-
-	var searchDomains []string
-	if dnsServer != nil {
-		searchDomains = dnsServer.SearchDomains()
-	}
-
-	return routes, searchDomains
-}

client/internal/ipcauth/privileged.go

@@ -91,12 +91,6 @@ func SelfDelegatesTo() (Identity, bool) {
 	return selfIdentity, true
 }
 
-// The values PrivilegedActorKey returns.
-const (
-	ActorKeyAdministrator = "administrator"
-	ActorKeyRoot          = "root"
-)
-
 // PrivilegedActor names the principal a privileged operation requires, for use
 // in messages shown to the user.
 func PrivilegedActor() string {
@@ -106,16 +100,6 @@ func PrivilegedActor() string {
 	return "root"
 }
 
-// PrivilegedActorKey identifies that principal without wording it, for a client
-// that writes its own message in the user's language. The words PrivilegedActor
-// returns are English, and a translated sentence cannot borrow them.
-func PrivilegedActorKey() string {
-	if runtime.GOOS == "windows" {
-		return ActorKeyAdministrator
-	}
-	return ActorKeyRoot
-}
-
 // ElevatedCommand renders a command so that running it grants the privileges the
 // operation needs. Windows has no in-line equivalent of sudo, so the command is
 // returned unchanged and the user is expected to run it from an elevated

client/internal/peer/status.go

@@ -1281,12 +1281,15 @@ func (d *Status) numOfPeers() int {
 	return len(d.peers) + len(d.offlinePeers)
 }
 
-// PublishEvent adds an event to the queue and distributes it to all subscribers
+// PublishEvent adds an event to the queue and distributes it to all subscribers.
+// msg is the English log-facing description; userMsg is the localizable
+// user-facing message, or nil for an internal control event that must not
+// surface as a notification.
 func (d *Status) PublishEvent(
 	severity proto.SystemEvent_Severity,
 	category proto.SystemEvent_Category,
 	msg string,
-	userMsg string,
+	userMsg *proto.UserMessage,
 	metadata map[string]string,
 ) {
 	event := &proto.SystemEvent{
@@ -1294,7 +1297,10 @@ func (d *Status) PublishEvent(
 		Severity:    severity,
 		Category:    category,
 		Message:     msg,
-		UserMessage: userMsg,
+		UserMessage: userMsg.Text(),
+		MessageKey:  string(userMsg.Key()),
+		MessageArgs: userMsg.Args(),
+		TitleKey:    string(userMsg.TitleKey()),
 		Metadata:    metadata,
 		Timestamp:   timestamppb.Now(),
 	}

client/internal/profilemanager/state.go

@@ -45,35 +45,12 @@ func (pm *ProfileManager) GetProfileState(id ID) (*ProfileState, error) {
 	return &state, nil
 }
 
-// SetProfileState writes the state file of the profile identified by id. Prefer
-// it over SetActiveProfileState whenever the caller knows which profile the data
-// belongs to: an SSO login spans seconds of user interaction, and the active
-// profile can change during it, which would file the account email under
-// whichever profile happened to be active when the flow returned.
-func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
+func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	configDir, err := getConfigDir()
 	if err != nil {
 		return fmt.Errorf("get config directory: %w", err)
 	}
 
-	if id == "" {
-		return fmt.Errorf("empty profile ID")
-	}
-	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
-		return fmt.Errorf("invalid profile ID: %q", id)
-	}
-
-	stateFile := filepath.Join(configDir, id.String()+".state.json")
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
-		return fmt.Errorf("write profile state: %w", err)
-	}
-
-	return nil
-}
-
-// SetActiveProfileState writes the state file of whichever profile is active at
-// call time. Use SetProfileState when the target profile is known.
-func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	activeProf, err := pm.GetActiveProfile()
 	if err != nil {
 		if errors.Is(err, ErrNoActiveProfile) {
@@ -82,7 +59,18 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 		return fmt.Errorf("get active profile: %w", err)
 	}
 
-	return pm.SetProfileState(activeProf.ID, state)
+	id := activeProf.ID
+	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
+		return fmt.Errorf("invalid active profile ID: %q", id)
+	}
+
+	stateFile := filepath.Join(configDir, id.String()+".state.json")
+	err = util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state)
+	if err != nil {
+		return fmt.Errorf("write profile state: %w", err)
+	}
+
+	return nil
 }
 
 // RemoveProfileState deletes the per-profile state file (which holds the

client/internal/routemanager/client/client.go

@@ -403,7 +403,7 @@ func (w *Watcher) connectEvent(route *route.Route) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_NETWORK,
 		"Default route added",
-		"Exit node connected.",
+		proto.NewUserMessage(proto.UserMsgExitNodeConnected),
 		meta,
 	)
 }
@@ -423,7 +423,7 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 
 	var severity proto.SystemEvent_Severity
 	var message string
-	var userMessage string
+	var userMessage *proto.UserMessage
 	meta := make(map[string]string)
 
 	if route != nil {
@@ -435,22 +435,22 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 	case reasonShutdown:
 		severity = proto.SystemEvent_INFO
 		message = "Default route removed"
-		userMessage = "Exit node disconnected."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnected)
 	case reasonRouteUpdate:
 		severity = proto.SystemEvent_INFO
 		message = "Default route updated due to configuration change"
 	case reasonPeerUpdate:
 		severity = proto.SystemEvent_WARNING
 		message = "Default route disconnected due to peer unreachability"
-		userMessage = "Exit node connection lost. Your internet access might be affected."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeConnectionLost)
 	case reasonHA:
 		severity = proto.SystemEvent_INFO
 		message = "Default route disconnected due to high availability change"
-		userMessage = "Exit node disconnected due to high availability change."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeHAChange)
 	default:
 		severity = proto.SystemEvent_ERROR
 		message = "Default route disconnected for unknown reasons"
-		userMessage = "Exit node disconnected for unknown reasons."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnectedUnknown)
 	}
 
 	w.statusRecorder.PublishEvent(

client/internal/routemanager/dnsinterceptor/handler.go

@@ -479,7 +479,7 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 
 // internalDnatFw checks if the firewall supports internal DNAT
 func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
-	if d.firewall == nil || d.fakeIPManager == nil || runtime.GOOS != "android" {
+	if d.firewall == nil || runtime.GOOS != "android" {
 		return nil, false
 	}
 	fw, ok := d.firewall.(internalDNATer)

client/internal/routemanager/manager.go

@@ -8,13 +8,14 @@ import (
 	"net/netip"
 	"net/url"
 	"runtime"
-	"sort"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"syscall"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
@@ -61,7 +62,7 @@ type Manager interface {
 	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
-	CurrentRouteRange() []string
+	InitialRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
 	ReconcilePeerAllowedIPs(peerKey string) error
@@ -75,8 +76,10 @@ type ManagerConfig struct {
 	WGInterface         iface.WGIface
 	StatusRecorder      *peer.Status
 	RelayManager        *relayClient.Manager
+	InitialRoutes       []*route.Route
 	StateManager        *statemanager.Manager
 	DNSServer           dns.Server
+	DNSFeatureFlag      bool
 	PeerStore           *peerstore.Store
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -146,12 +149,45 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	useNoop := netstack.IsEnabled() || config.DisableClientRoutes
 	dm.setupRefCounters(useNoop)
 
+	// don't proceed with client routes if it is disabled
+	if config.DisableClientRoutes {
+		return dm
+	}
+
+	if runtime.GOOS == "android" {
+		dm.setupAndroidRoutes(config)
+	}
 	return dm
 }
+func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
+	cr := m.initialClientRoutes(config.InitialRoutes)
 
-func (m *DefaultManager) enableFakeIPRoutes() {
-	m.fakeIPManager = fakeip.NewManager()
-	m.notifier.NotifyRouteChange()
+	routesForComparison := slices.Clone(cr)
+
+	if config.DNSFeatureFlag {
+		m.fakeIPManager = fakeip.NewManager()
+
+		v4ID := uuid.NewString()
+		fakeIPRoute := &route.Route{
+			ID:          route.ID(v4ID),
+			Network:     m.fakeIPManager.GetFakeIPBlock(),
+			NetID:       route.NetID(v4ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv4Network,
+		}
+		v6ID := uuid.NewString()
+		fakeIPv6Route := &route.Route{
+			ID:          route.ID(v6ID),
+			Network:     m.fakeIPManager.GetFakeIPv6Block(),
+			NetID:       route.NetID(v6ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv6Network,
+		}
+		cr = append(cr, fakeIPRoute, fakeIPv6Route)
+		m.notifier.SetFakeIPRoutes([]*route.Route{fakeIPRoute, fakeIPv6Route})
+	}
+
+	m.notifier.SetInitialClientRoutes(cr, routesForComparison)
 }
 
 func (m *DefaultManager) setupRefCounters(useNoop bool) {
@@ -428,9 +464,6 @@ func (m *DefaultManager) UpdateRoutes(
 
 	var merr *multierror.Error
 	if !m.disableClientRoutes {
-		if runtime.GOOS == "android" && useNewDNSRoute && m.fakeIPManager == nil {
-			m.enableFakeIPRoutes()
-		}
 
 		// Update route selector based on management server's isSelected status
 		m.updateRouteSelectorFromManagement(clientRoutes)
@@ -467,32 +500,9 @@ func (m *DefaultManager) SetRouteChangeListener(listener listener.NetworkChangeL
 	m.notifier.SetListener(listener)
 }
 
-// CurrentRouteRange returns the current TUN route list. It is used by mobile systems
-func (m *DefaultManager) CurrentRouteRange() []string {
-	m.mux.Lock()
-	defer m.mux.Unlock()
-
-	if m.disableClientRoutes {
-		return nil
-	}
-
-	filtered := m.routeSelector.FilterSelectedExitNodes(m.clientRoutes)
-	var nets []string
-	for _, routes := range filtered {
-		for _, r := range routes {
-			if r.IsDynamic() {
-				continue
-			}
-			nets = append(nets, r.NetString())
-		}
-	}
-
-	if m.fakeIPManager != nil {
-		nets = append(nets, m.fakeIPManager.GetFakeIPBlock().String(), m.fakeIPManager.GetFakeIPv6Block().String())
-	}
-
-	sort.Strings(nets)
-	return nets
+// InitialRouteRange return the list of initial routes. It used by mobile systems
+func (m *DefaultManager) InitialRouteRange() []string {
+	return m.notifier.GetInitialRouteRanges()
 }
 
 // GetRouteSelector returns the route selector
@@ -690,6 +700,16 @@ func (m *DefaultManager) ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]
 	return newServerRoutesMap, newClientRoutesIDMap
 }
 
+func (m *DefaultManager) initialClientRoutes(initialRoutes []*route.Route) []*route.Route {
+	_, crMap := m.ClassifyRoutes(initialRoutes)
+	rs := make([]*route.Route, 0, len(crMap))
+	for _, routes := range crMap {
+		rs = append(rs, routes...)
+	}
+
+	return rs
+}
+
 func isRouteSupported(route *route.Route) bool {
 	if netstack.IsEnabled() || !nbnet.CustomRoutingDisabled() || route.IsDynamic() {
 		return true

client/internal/routemanager/mock.go

@@ -30,8 +30,8 @@ func (m *MockManager) Init() error {
 	return nil
 }
 
-// CurrentRouteRange mock implementation of CurrentRouteRange from Manager interface
-func (m *MockManager) CurrentRouteRange() []string {
+// InitialRouteRange mock implementation of InitialRouteRange from Manager interface
+func (m *MockManager) InitialRouteRange() []string {
 	return nil
 }
 

client/internal/routemanager/notifier/notifier_android.go

@@ -6,6 +6,7 @@ import (
 	"net/netip"
 	"slices"
 	"sort"
+	"strings"
 	"sync"
 
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -13,15 +14,12 @@ import (
 )
 
 type Notifier struct {
-	mu sync.Mutex
-
-	// currentRoutes is the last announced route set. It exists only to
-	// suppress noise: without it every network map sync would trigger the
-	// Java side, even when the routes did not change. The actual TUN route
-	// state is owned by the route manager and pulled from there.
+	initialRoutes []*route.Route
 	currentRoutes []*route.Route
+	fakeIPRoutes  []*route.Route
 
-	listener listener.NetworkChangeListener
+	listener    listener.NetworkChangeListener
+	listenerMux sync.Mutex
 }
 
 func NewNotifier() *Notifier {
@@ -29,15 +27,20 @@ func NewNotifier() *Notifier {
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.notifyLocked()
+// SetInitialClientRoutes stores the initial route sets for TUN configuration.
+func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
+	n.initialRoutes = filterStatic(initialRoutes)
+	n.currentRoutes = filterStatic(routesForComparison)
+}
+
+// SetFakeIPRoutes stores the fake IP routes to be included in every TUN rebuild.
+func (n *Notifier) SetFakeIPRoutes(routes []*route.Route) {
+	n.fakeIPRoutes = routes
 }
 
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
@@ -51,32 +54,46 @@ func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 		}
 	}
 
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	if !hasRouteDiff(n.currentRoutes, newRoutes) {
+	if !n.hasRouteDiff(n.currentRoutes, newRoutes) {
 		return
 	}
 
 	n.currentRoutes = newRoutes
-	n.notifyLocked()
+	n.notify()
 }
 
 func (n *Notifier) OnNewPrefixes([]netip.Prefix) {
 	// Not used on Android
 }
 
-func (n *Notifier) notifyLocked() {
+func (n *Notifier) notify() {
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	if n.listener == nil {
 		return
 	}
-	n.listener.OnNetworkChanged("")
+
+	allRoutes := slices.Clone(n.currentRoutes)
+	allRoutes = append(allRoutes, n.fakeIPRoutes...)
+
+	routeStrings := n.routesToStrings(allRoutes)
+	sort.Strings(routeStrings)
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged(strings.Join(routeStrings, ","))
+	}(n.listener)
 }
 
-func (n *Notifier) Close() {
-	// unused
+func filterStatic(routes []*route.Route) []*route.Route {
+	out := make([]*route.Route, 0, len(routes))
+	for _, r := range routes {
+		if !r.IsDynamic() {
+			out = append(out, r)
+		}
+	}
+	return out
 }
 
-func routesToStrings(routes []*route.Route) []string {
+func (n *Notifier) routesToStrings(routes []*route.Route) []string {
 	nets := make([]string, 0, len(routes))
 	for _, r := range routes {
 		nets = append(nets, r.NetString())
@@ -84,10 +101,25 @@ func routesToStrings(routes []*route.Route) []string {
 	return nets
 }
 
-func hasRouteDiff(a []*route.Route, b []*route.Route) bool {
-	as := routesToStrings(a)
-	bs := routesToStrings(b)
-	sort.Strings(as)
-	sort.Strings(bs)
-	return !slices.Equal(as, bs)
+func (n *Notifier) hasRouteDiff(a []*route.Route, b []*route.Route) bool {
+	slices.SortFunc(a, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+	slices.SortFunc(b, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+
+	return !slices.EqualFunc(a, b, func(x, y *route.Route) bool {
+		return x.NetString() == y.NetString()
+	})
+}
+
+func (n *Notifier) GetInitialRouteRanges() []string {
+	initialStrings := n.routesToStrings(n.initialRoutes)
+	sort.Strings(initialStrings)
+	return initialStrings
+}
+
+func (n *Notifier) Close() {
+	// unused
 }

client/internal/routemanager/notifier/notifier_ios.go

@@ -29,7 +29,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// iOS doesn't care about initial routes
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on iOS
 }
 

client/internal/routemanager/notifier/notifier_other.go

@@ -19,7 +19,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// Not used on non-mobile platforms
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on non-mobile platforms
 }
 
@@ -31,6 +35,10 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	// Not used on non-mobile platforms
 }
 
+func (n *Notifier) GetInitialRouteRanges() []string {
+	return []string{}
+}
+
 func (n *Notifier) Close() {
 	// unused
 }

client/internal/updater/installer/installer_run_darwin.go

@@ -98,44 +98,47 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 func (u *Installer) startUIAsUser() error {
 	log.Infof("starting netbird-ui: %s", uiBinary)
 
-	username, err := consoleUser()
+	// Get the current console user
+	cmd := exec.Command("stat", "-f", "%Su", "/dev/console")
+	output, err := cmd.Output()
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get console user: %w", err)
 	}
 
+	username := strings.TrimSpace(string(output))
+	if username == "" || username == "root" {
+		return fmt.Errorf("no active user session found")
+	}
+
+	log.Infof("starting UI for user: %s", username)
+
+	// Get user's UID
 	userInfo, err := user.Lookup(username)
 	if err != nil {
-		return fmt.Errorf("lookup user %s: %w", username, err)
+		return fmt.Errorf("failed to lookup user %s: %w", username, err)
 	}
 
-	log.Infof("starting UI for user: %s (uid %s)", username, userInfo.Uid)
-
-	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "sudo", "-u", username, "-H", "open", "-a", uiBinary)
+	// Start the UI process as the console user using launchctl
+	// This ensures the app runs in the user's context with proper GUI access
+	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "open", "-a", uiBinary)
 	log.Infof("launchCmd: %s", launchCmd.String())
+	// Set the user's home directory for proper macOS app behavior
+	launchCmd.Env = append(os.Environ(), "HOME="+userInfo.HomeDir)
+	log.Infof("set HOME environment variable: %s", userInfo.HomeDir)
 
-	if err := launchCmd.Run(); err != nil {
-		return fmt.Errorf("run UI launch: %w", err)
+	if err := launchCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start UI process: %w", err)
+	}
+
+	// Release the process so it can run independently
+	if err := launchCmd.Process.Release(); err != nil {
+		log.Warnf("failed to release UI process: %v", err)
 	}
 
 	log.Infof("netbird-ui started successfully for user %s", username)
 	return nil
 }
 
-func consoleUser() (string, error) {
-	output, err := exec.Command("stat", "-f", "%Su", "/dev/console").Output()
-	if err != nil {
-		return "", fmt.Errorf("get console user: %w", err)
-	}
-
-	username := strings.TrimSpace(string(output))
-	switch username {
-	case "", "root", "loginwindow", "_mbsetupuser":
-		return "", fmt.Errorf("no active GUI user session, console user: %q", username)
-	}
-
-	return username, nil
-}
-
 func (u *Installer) installPkgFile(ctx context.Context, path string) error {
 	log.Infof("installing pkg file: %s", path)
 

client/internal/updater/manager.go

@@ -94,7 +94,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			fmt.Sprintf("Auto-update failed: %s", reason),
+			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, reason),
 			nil,
 		)
 	}
@@ -115,7 +115,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update completed",
-			fmt.Sprintf("Your NetBird Client was auto-updated to version %s", m.currentVersion),
+			cProto.NewUserMessage(cProto.UserMsgUpdateCompleted, cProto.ArgVersion, m.currentVersion),
 			nil,
 		)
 		return
@@ -272,7 +272,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": latestVersion.String()},
 		)
 		return
@@ -283,7 +283,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": pendingVersion.String(), "enforced": "true"},
 		)
 	}
@@ -384,7 +384,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": updateVersion.String()},
 		)
 		return
@@ -401,7 +401,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 		cProto.SystemEvent_INFO,
 		cProto.SystemEvent_SYSTEM,
 		"New version available",
-		"",
+		nil,
 		map[string]string{"new_version_available": updateVersion.String(), "enforced": "true"},
 	)
 }
@@ -411,14 +411,14 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"Updating client",
-		"Installing update now.",
+		cProto.NewUserMessage(cProto.UserMsgUpdateInstalling),
 		nil,
 	)
 	m.statusRecorder.PublishEvent(
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"",
-		"",
+		nil,
 		map[string]string{"progress_window": "show", "version": pendingVersion.String()},
 	)
 
@@ -441,7 +441,7 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			fmt.Sprintf("Auto-update failed: %v", err),
+			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, err.Error()),
 			nil,
 		)
 		return err

client/proto/daemon.pb.go

@@ -3909,14 +3909,30 @@ func (*SubscribeRequest) Descriptor() ([]byte, []int) {
 }
 
 type SystemEvent struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Severity      SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
-	Category      SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
-	Message       string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
-	UserMessage   string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
-	Timestamp     *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
-	Metadata      map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	state    protoimpl.MessageState `protogen:"open.v1"`
+	Id       string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Severity SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
+	Category SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
+	Message  string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
+	// userMessage is the daemon's English rendering of messageKey, kept for the
+	// CLI and for UIs that predate messageKey. UIs that localise read messageKey
+	// and treat this as the fallback.
+	UserMessage string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
+	Timestamp   *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	Metadata    map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// messageKey names a user-facing message in a stable, locale-independent
+	// form. A UI resolves it against its own translation bundle and substitutes
+	// messageArgs; an unrecognised key falls back to userMessage. Empty on events
+	// that carry no user-facing text.
+	MessageKey string `protobuf:"bytes,8,opt,name=messageKey,proto3" json:"messageKey,omitempty"`
+	// messageArgs holds the placeholder name/value pairs for messageKey, e.g.
+	// {"version": "0.60.1"} for a "{version}" template. Values are data the
+	// daemon cannot localise (versions, addresses, error text).
+	MessageArgs map[string]string `protobuf:"bytes,9,rep,name=messageArgs,proto3" json:"messageArgs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// titleKey names the notification title in the same way as messageKey. Empty
+	// when the event has no dedicated title, in which case a UI composes one from
+	// severity and category.
+	TitleKey      string `protobuf:"bytes,10,opt,name=titleKey,proto3" json:"titleKey,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -4000,6 +4016,27 @@ func (x *SystemEvent) GetMetadata() map[string]string {
 	return nil
 }
 
+func (x *SystemEvent) GetMessageKey() string {
+	if x != nil {
+		return x.MessageKey
+	}
+	return ""
+}
+
+func (x *SystemEvent) GetMessageArgs() map[string]string {
+	if x != nil {
+		return x.MessageArgs
+	}
+	return nil
+}
+
+func (x *SystemEvent) GetTitleKey() string {
+	if x != nil {
+		return x.TitleKey
+	}
+	return ""
+}
+
 type GetEventsRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -7332,7 +7369,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x13TracePacketResponse\x12*\n" +
 	"\x06stages\x18\x01 \x03(\v2\x12.daemon.TraceStageR\x06stages\x12+\n" +
 	"\x11final_disposition\x18\x02 \x01(\bR\x10finalDisposition\"\x12\n" +
-	"\x10SubscribeRequest\"\x93\x04\n" +
+	"\x10SubscribeRequest\"\xd7\x05\n" +
 	"\vSystemEvent\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x128\n" +
 	"\bseverity\x18\x02 \x01(\x0e2\x1c.daemon.SystemEvent.SeverityR\bseverity\x128\n" +
@@ -7340,9 +7377,18 @@ const file_daemon_proto_rawDesc = "" +
 	"\amessage\x18\x04 \x01(\tR\amessage\x12 \n" +
 	"\vuserMessage\x18\x05 \x01(\tR\vuserMessage\x128\n" +
 	"\ttimestamp\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12=\n" +
-	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x1a;\n" +
+	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x12\x1e\n" +
+	"\n" +
+	"messageKey\x18\b \x01(\tR\n" +
+	"messageKey\x12F\n" +
+	"\vmessageArgs\x18\t \x03(\v2$.daemon.SystemEvent.MessageArgsEntryR\vmessageArgs\x12\x1a\n" +
+	"\btitleKey\x18\n" +
+	" \x01(\tR\btitleKey\x1a;\n" +
 	"\rMetadataEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10MessageArgsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\":\n" +
 	"\bSeverity\x12\b\n" +
 	"\x04INFO\x10\x00\x12\v\n" +
@@ -7660,7 +7706,7 @@ func file_daemon_proto_rawDescGZIP() []byte {
 }
 
 var file_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 110)
+var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 111)
 var file_daemon_proto_goTypes = []any{
 	(LogLevel)(0),                              // 0: daemon.LogLevel
 	(ExposeProtocol)(0),                        // 1: daemon.ExposeProtocol
@@ -7776,16 +7822,17 @@ var file_daemon_proto_goTypes = []any{
 	nil,                                        // 111: daemon.Network.ResolvedIPsEntry
 	(*PortInfo_Range)(nil),                     // 112: daemon.PortInfo.Range
 	nil,                                        // 113: daemon.SystemEvent.MetadataEntry
-	(*durationpb.Duration)(nil),                // 114: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),              // 115: google.protobuf.Timestamp
+	nil,                                        // 114: daemon.SystemEvent.MessageArgsEntry
+	(*durationpb.Duration)(nil),                // 115: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),              // 116: google.protobuf.Timestamp
 }
 var file_daemon_proto_depIdxs = []int32{
-	114, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	115, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
 	25,  // 1: daemon.StatusResponse.fullStatus:type_name -> daemon.FullStatus
-	115, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	115, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
-	115, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
-	114, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
+	116, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	116, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
+	116, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
+	115, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
 	23,  // 6: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
 	20,  // 7: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
 	19,  // 8: daemon.FullStatus.signalState:type_name -> daemon.SignalState
@@ -7808,114 +7855,115 @@ var file_daemon_proto_depIdxs = []int32{
 	54,  // 25: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
 	2,   // 26: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
 	3,   // 27: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
-	115, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
+	116, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
 	113, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
-	57,  // 30: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
-	114, // 31: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
-	72,  // 32: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
-	115, // 33: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	1,   // 34: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
-	104, // 35: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
-	114, // 36: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
-	114, // 37: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
-	30,  // 38: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
-	5,   // 39: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
-	7,   // 40: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
-	9,   // 41: daemon.DaemonService.Up:input_type -> daemon.UpRequest
-	11,  // 42: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
-	11,  // 43: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
-	13,  // 44: daemon.DaemonService.Down:input_type -> daemon.DownRequest
-	15,  // 45: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
-	26,  // 46: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
-	28,  // 47: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
-	28,  // 48: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
-	4,   // 49: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
-	35,  // 50: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
-	37,  // 51: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
-	39,  // 52: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
-	44,  // 53: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
-	46,  // 54: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
-	48,  // 55: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
-	50,  // 56: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
-	53,  // 57: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
-	105, // 58: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
-	107, // 59: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
-	109, // 60: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
-	56,  // 61: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
-	58,  // 62: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
-	41,  // 63: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
-	60,  // 64: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
-	62,  // 65: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
-	64,  // 66: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
-	66,  // 67: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
-	68,  // 68: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
-	70,  // 69: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
-	73,  // 70: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
-	75,  // 71: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
-	79,  // 72: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
-	82,  // 73: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
-	84,  // 74: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
-	86,  // 75: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
-	88,  // 76: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
-	90,  // 77: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
-	92,  // 78: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
-	94,  // 79: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
-	96,  // 80: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
-	98,  // 81: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
-	100, // 82: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
-	102, // 83: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
-	77,  // 84: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
-	6,   // 85: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
-	8,   // 86: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
-	10,  // 87: daemon.DaemonService.Up:output_type -> daemon.UpResponse
-	12,  // 88: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
-	12,  // 89: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
-	14,  // 90: daemon.DaemonService.Down:output_type -> daemon.DownResponse
-	16,  // 91: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
-	27,  // 92: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
-	29,  // 93: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
-	29,  // 94: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
-	34,  // 95: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
-	36,  // 96: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
-	38,  // 97: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
-	40,  // 98: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
-	45,  // 99: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
-	47,  // 100: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
-	49,  // 101: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
-	51,  // 102: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
-	55,  // 103: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
-	106, // 104: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
-	108, // 105: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
-	110, // 106: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
-	57,  // 107: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
-	59,  // 108: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
-	42,  // 109: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
-	61,  // 110: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
-	63,  // 111: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
-	65,  // 112: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
-	67,  // 113: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
-	69,  // 114: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
-	71,  // 115: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
-	74,  // 116: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
-	76,  // 117: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
-	80,  // 118: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
-	83,  // 119: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
-	85,  // 120: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
-	87,  // 121: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
-	89,  // 122: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
-	91,  // 123: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
-	93,  // 124: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
-	95,  // 125: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
-	97,  // 126: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
-	99,  // 127: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
-	101, // 128: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
-	103, // 129: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
-	78,  // 130: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
-	85,  // [85:131] is the sub-list for method output_type
-	39,  // [39:85] is the sub-list for method input_type
-	39,  // [39:39] is the sub-list for extension type_name
-	39,  // [39:39] is the sub-list for extension extendee
-	0,   // [0:39] is the sub-list for field type_name
+	114, // 30: daemon.SystemEvent.messageArgs:type_name -> daemon.SystemEvent.MessageArgsEntry
+	57,  // 31: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
+	115, // 32: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	72,  // 33: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
+	116, // 34: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	1,   // 35: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
+	104, // 36: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
+	115, // 37: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
+	115, // 38: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
+	30,  // 39: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
+	5,   // 40: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
+	7,   // 41: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
+	9,   // 42: daemon.DaemonService.Up:input_type -> daemon.UpRequest
+	11,  // 43: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
+	11,  // 44: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
+	13,  // 45: daemon.DaemonService.Down:input_type -> daemon.DownRequest
+	15,  // 46: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
+	26,  // 47: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
+	28,  // 48: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
+	28,  // 49: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
+	4,   // 50: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
+	35,  // 51: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
+	37,  // 52: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
+	39,  // 53: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
+	44,  // 54: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
+	46,  // 55: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
+	48,  // 56: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
+	50,  // 57: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
+	53,  // 58: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
+	105, // 59: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
+	107, // 60: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
+	109, // 61: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
+	56,  // 62: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
+	58,  // 63: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
+	41,  // 64: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
+	60,  // 65: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
+	62,  // 66: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
+	64,  // 67: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
+	66,  // 68: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
+	68,  // 69: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
+	70,  // 70: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
+	73,  // 71: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
+	75,  // 72: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
+	79,  // 73: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
+	82,  // 74: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
+	84,  // 75: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
+	86,  // 76: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
+	88,  // 77: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
+	90,  // 78: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
+	92,  // 79: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
+	94,  // 80: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
+	96,  // 81: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
+	98,  // 82: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
+	100, // 83: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
+	102, // 84: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
+	77,  // 85: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
+	6,   // 86: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
+	8,   // 87: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
+	10,  // 88: daemon.DaemonService.Up:output_type -> daemon.UpResponse
+	12,  // 89: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
+	12,  // 90: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
+	14,  // 91: daemon.DaemonService.Down:output_type -> daemon.DownResponse
+	16,  // 92: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
+	27,  // 93: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
+	29,  // 94: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
+	29,  // 95: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
+	34,  // 96: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
+	36,  // 97: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
+	38,  // 98: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
+	40,  // 99: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
+	45,  // 100: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
+	47,  // 101: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
+	49,  // 102: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
+	51,  // 103: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
+	55,  // 104: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
+	106, // 105: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
+	108, // 106: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
+	110, // 107: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
+	57,  // 108: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
+	59,  // 109: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
+	42,  // 110: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
+	61,  // 111: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
+	63,  // 112: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
+	65,  // 113: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
+	67,  // 114: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
+	69,  // 115: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
+	71,  // 116: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
+	74,  // 117: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
+	76,  // 118: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
+	80,  // 119: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
+	83,  // 120: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
+	85,  // 121: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
+	87,  // 122: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
+	89,  // 123: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
+	91,  // 124: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
+	93,  // 125: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
+	95,  // 126: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
+	97,  // 127: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
+	99,  // 128: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
+	101, // 129: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
+	103, // 130: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
+	78,  // 131: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
+	86,  // [86:132] is the sub-list for method output_type
+	40,  // [40:86] is the sub-list for method input_type
+	40,  // [40:40] is the sub-list for extension type_name
+	40,  // [40:40] is the sub-list for extension extendee
+	0,   // [0:40] is the sub-list for field type_name
 }
 
 func init() { file_daemon_proto_init() }
@@ -7947,7 +7995,7 @@ func file_daemon_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_proto_rawDesc), len(file_daemon_proto_rawDesc)),
 			NumEnums:      4,
-			NumMessages:   110,
+			NumMessages:   111,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

client/proto/daemon.proto

@@ -677,9 +677,25 @@ message SystemEvent {
   Severity severity = 2;
   Category category = 3;
   string message = 4;
+  // userMessage is the daemon's English rendering of messageKey, kept for the
+  // CLI and for UIs that predate messageKey. UIs that localise read messageKey
+  // and treat this as the fallback.
   string userMessage = 5;
   google.protobuf.Timestamp timestamp = 6;
   map<string, string> metadata = 7;
+  // messageKey names a user-facing message in a stable, locale-independent
+  // form. A UI resolves it against its own translation bundle and substitutes
+  // messageArgs; an unrecognised key falls back to userMessage. Empty on events
+  // that carry no user-facing text.
+  string messageKey = 8;
+  // messageArgs holds the placeholder name/value pairs for messageKey, e.g.
+  // {"version": "0.60.1"} for a "{version}" template. Values are data the
+  // daemon cannot localise (versions, addresses, error text).
+  map<string, string> messageArgs = 9;
+  // titleKey names the notification title in the same way as messageKey. Empty
+  // when the event has no dedicated title, in which case a UI composes one from
+  // severity and category.
+  string titleKey = 10;
 }
 
 message GetEventsRequest {}

client/proto/metadata.go

@@ -43,10 +43,10 @@ const (
 	// UIs to re-fetch their cached config + features. UserMessage is empty so
 	// the change is silent; the source is carried in MetadataSourceKey.
 	MetadataTypeConfigChanged = "config_changed"
-	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. The
-	// daemon stamps it with a (non-localised) UserMessage; the UI suppresses
-	// that and builds its own localised toast off the paired config_changed
-	// event instead.
+	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. It is
+	// the user-facing half of the pair: the daemon stamps it with the message
+	// and title keys a UI localises, while the paired config_changed event stays
+	// silent and only drives the cache refresh.
 	MetadataTypePolicyApplied = "policy_applied"
 
 	// MetadataSourceKey is the SystemEvent.metadata key carrying what

client/proto/usermsg.go

@@ -0,0 +1,183 @@
+package proto
+
+import (
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// UserMessageKey names a piece of user-facing SystemEvent text in a
+// locale-independent form. The daemon has no notion of the user's language, so it
+// publishes the key and lets each UI resolve it.
+//
+// The value doubles as the lookup key in the desktop UI's translation bundles
+// (client/ui/i18n/locales/<code>/common.json), so renaming a constant here means
+// renaming the key in every bundle. The tests in client/ui/i18n lock the two
+// sides together. Keys that predate this mechanism keep their original bundle
+// names so the shipped translations still apply.
+type UserMessageKey string
+
+// Message-body keys published by the daemon. Every key needs an entry in
+// UserMessageTexts below and a translation in the UI bundles.
+const (
+	// UserMsgPanic is the CRITICAL event published from the recover() guard in
+	// the connect loop.
+	UserMsgPanic UserMessageKey = "event.panic"
+
+	// UserMsgDNSRecovered and UserMsgDNSUnreachable bracket a nameserver
+	// group's health transitions.
+	UserMsgDNSRecovered   UserMessageKey = "event.dns.recovered"
+	UserMsgDNSUnreachable UserMessageKey = "event.dns.unreachable"
+
+	// Exit-node (default route) transitions.
+	UserMsgExitNodeConnected           UserMessageKey = "event.exitNode.connected"
+	UserMsgExitNodeDisconnected        UserMessageKey = "event.exitNode.disconnected"
+	UserMsgExitNodeConnectionLost      UserMessageKey = "event.exitNode.connectionLost"
+	UserMsgExitNodeHAChange            UserMessageKey = "event.exitNode.haChange"
+	UserMsgExitNodeDisconnectedUnknown UserMessageKey = "event.exitNode.disconnectedUnknown"
+
+	// Auto-update lifecycle. UserMsgUpdateFailed takes a {reason} argument and
+	// UserMsgUpdateCompleted a {version}.
+	UserMsgUpdateInstalling UserMessageKey = "event.update.installing"
+	UserMsgUpdateCompleted  UserMessageKey = "event.update.completed"
+	UserMsgUpdateFailed     UserMessageKey = "event.update.failed"
+
+	// UserMsgMDMPolicyApplied reports that an MDM policy replaced the config.
+	UserMsgMDMPolicyApplied UserMessageKey = "notify.mdm.policyApplied.body"
+
+	// Session-expiry events. UserMsgSessionExpiresIn takes a {remaining}
+	// argument; the "soon" variant is published when the deadline has already
+	// passed by the time the warning fires.
+	UserMsgSessionExpiresIn      UserMessageKey = "notify.sessionWarning.body"
+	UserMsgSessionExpiresSoon    UserMessageKey = "notify.sessionWarning.bodyGeneric"
+	UserMsgSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.body"
+)
+
+// Notification-title keys. An event without one leaves titleKey empty and the UI
+// composes a title from severity and category, which is what every event did
+// before message keys existed. These carry no English fallback: a UI old enough
+// to ignore titleKey already builds its own title.
+const (
+	TitleMDMPolicyApplied      UserMessageKey = "notify.mdm.policyApplied.title"
+	TitleSessionWarning        UserMessageKey = "notify.sessionWarning.title"
+	TitleSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.title"
+)
+
+// UserMessageTitleKeys lists every title key a daemon can publish. It sits next
+// to the constants above because the two must grow together: a title key missing
+// from this slice ships untranslated, and the i18n test that would have caught it
+// reads this list.
+var UserMessageTitleKeys = []UserMessageKey{
+	TitleMDMPolicyApplied,
+	TitleSessionWarning,
+	TitleSessionDeadlineReject,
+}
+
+// ArgReason, ArgVersion and ArgRemaining are the placeholder names used by the
+// templates below. Producers pass them to NewUserMessage; the UI bundles use the
+// same names inside {}.
+const (
+	ArgReason    = "reason"
+	ArgVersion   = "version"
+	ArgRemaining = "remaining"
+)
+
+// UserMessageTexts is the English rendering of every body key, and the source of
+// the SystemEvent.userMessage fallback that the CLI and pre-messageKey UIs read.
+// It must match the en bundle, which the i18n test enforces.
+var UserMessageTexts = map[UserMessageKey]string{
+	UserMsgPanic:                       "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
+	UserMsgDNSRecovered:                "DNS servers are reachable again.",
+	UserMsgDNSUnreachable:              "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+	UserMsgExitNodeConnected:           "Exit node connected.",
+	UserMsgExitNodeDisconnected:        "Exit node disconnected.",
+	UserMsgExitNodeConnectionLost:      "Exit node connection lost. Your internet access might be affected.",
+	UserMsgExitNodeHAChange:            "Exit node disconnected due to high availability change.",
+	UserMsgExitNodeDisconnectedUnknown: "Exit node disconnected for unknown reasons.",
+	UserMsgUpdateInstalling:            "Installing update now.",
+	UserMsgUpdateCompleted:             "Your NetBird client was auto-updated to version {version}.",
+	UserMsgUpdateFailed:                "Auto-update failed: {reason}",
+	UserMsgMDMPolicyApplied:            "Your NetBird configuration was updated by your IT policy.",
+	UserMsgSessionExpiresIn:            "Your NetBird session expires in {remaining}. Click Extend now to renew.",
+	UserMsgSessionExpiresSoon:          "Your NetBird session is about to expire. Click Extend now to renew.",
+	UserMsgSessionDeadlineReject:       "The server sent an invalid session deadline. Please sign in again.",
+}
+
+// UserMessage is a localizable user-facing event message: a stable body key, an
+// optional title key, and the placeholder values to substitute. A nil
+// *UserMessage carries no user-facing text, which is how internal control events
+// are published.
+type UserMessage struct {
+	key   UserMessageKey
+	title UserMessageKey
+	args  map[string]string
+}
+
+// NewUserMessage builds a UserMessage from key and flat placeholder name/value
+// pairs, e.g. NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"). An
+// unpaired trailing argument is dropped.
+func NewUserMessage(key UserMessageKey, args ...string) *UserMessage {
+	m := &UserMessage{key: key}
+	if len(args)%2 != 0 {
+		log.Debugf("user message %q: placeholder args not paired: %d items, last dropped", key, len(args))
+		args = args[:len(args)-1]
+	}
+	if len(args) > 0 {
+		m.args = make(map[string]string, len(args)/2)
+		for i := 0; i < len(args); i += 2 {
+			m.args[args[i]] = args[i+1]
+		}
+	}
+	return m
+}
+
+// WithTitle attaches a notification title key and returns m, so it chains onto
+// NewUserMessage.
+func (m *UserMessage) WithTitle(key UserMessageKey) *UserMessage {
+	m.title = key
+	return m
+}
+
+// Key returns the body key, or the empty key for a nil message.
+func (m *UserMessage) Key() UserMessageKey {
+	if m == nil {
+		return ""
+	}
+	return m.key
+}
+
+// TitleKey returns the title key, which is empty unless WithTitle was called.
+func (m *UserMessage) TitleKey() UserMessageKey {
+	if m == nil {
+		return ""
+	}
+	return m.title
+}
+
+// Args returns the placeholder values, or nil for a nil message. The map is the
+// message's own and must not be mutated by the caller; it is handed straight to
+// SystemEvent.messageArgs.
+func (m *UserMessage) Args() map[string]string {
+	if m == nil {
+		return nil
+	}
+	return m.args
+}
+
+// Text renders the English fallback for m, with placeholders substituted. A nil
+// message, or a key with no registered template, renders empty so a UI treats
+// the event as carrying no user-facing text.
+func (m *UserMessage) Text() string {
+	if m == nil {
+		return ""
+	}
+	tmpl, ok := UserMessageTexts[m.key]
+	if !ok {
+		log.Warnf("no English template for user message key %q", m.key)
+		return ""
+	}
+	for name, value := range m.args {
+		tmpl = strings.ReplaceAll(tmpl, "{"+name+"}", value)
+	}
+	return tmpl
+}

client/proto/usermsg_test.go

@@ -0,0 +1,91 @@
+package proto
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUserMessageText(t *testing.T) {
+	tests := []struct {
+		name string
+		msg  *UserMessage
+		want string
+	}{
+		{
+			name: "no placeholders",
+			msg:  NewUserMessage(UserMsgExitNodeConnected),
+			want: "Exit node connected.",
+		},
+		{
+			name: "placeholder substituted",
+			msg:  NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"),
+			want: "Your NetBird client was auto-updated to version 0.60.1.",
+		},
+		{
+			// A dangling arg is a caller mistake; dropping it must still yield a
+			// readable sentence rather than panicking on the wire path.
+			name: "unpaired trailing arg dropped",
+			msg:  NewUserMessage(UserMsgUpdateFailed, ArgReason, "disk full", "extra"),
+			want: "Auto-update failed: disk full",
+		},
+		{
+			name: "unknown key renders empty so the UI treats the event as silent",
+			msg:  NewUserMessage("event.notRegistered"),
+			want: "",
+		},
+		{
+			name: "nil message carries no text",
+			msg:  nil,
+			want: "",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.msg.Text())
+		})
+	}
+}
+
+// A nil *UserMessage is how every internal control event is published, so the
+// accessors must stay usable without a nil check at each of the ~25 call sites.
+func TestNilUserMessageAccessors(t *testing.T) {
+	var msg *UserMessage
+
+	assert.Empty(t, msg.Key(), "nil message must have no body key")
+	assert.Empty(t, msg.TitleKey(), "nil message must have no title key")
+	assert.Nil(t, msg.Args(), "nil message must have no args")
+	assert.Empty(t, msg.Text(), "nil message must render empty")
+}
+
+func TestUserMessageArgsAndTitle(t *testing.T) {
+	msg := NewUserMessage(UserMsgSessionExpiresIn, ArgRemaining, "10m").
+		WithTitle(TitleSessionWarning)
+
+	assert.Equal(t, UserMsgSessionExpiresIn, msg.Key())
+	assert.Equal(t, TitleSessionWarning, msg.TitleKey())
+	assert.Equal(t, map[string]string{ArgRemaining: "10m"}, msg.Args())
+	assert.Equal(t, "Your NetBird session expires in 10m. Click Extend now to renew.", msg.Text())
+}
+
+// Every registered template must be reachable: a key whose text is empty would
+// publish an event with a key but no fallback for the CLI and older UIs.
+func TestUserMessageTextsAreNonEmpty(t *testing.T) {
+	texts := UserMessageTexts
+	assert.NotEmpty(t, texts, "the catalog must not be empty")
+
+	for key, text := range texts {
+		assert.NotEmpty(t, text, "message key %q has an empty template", key)
+		assert.NotEmpty(t, key, "the catalog must not contain an empty key")
+	}
+}
+
+func TestUserMessageTitleKeysAreUnique(t *testing.T) {
+	seen := make(map[UserMessageKey]struct{})
+	for _, key := range UserMessageTitleKeys {
+		assert.NotEmpty(t, key, "title keys must not be empty")
+		_, dup := seen[key]
+		assert.False(t, dup, "title key %q listed twice", key)
+		seen[key] = struct{}{}
+	}
+}

client/server/login_outcome_test.go

@@ -1,110 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A login that never reached Management is not a decision about the peer's
-// credentials, so it must come back as a retryable error rather than an SSO
-// prompt: the user cannot finish a browser login while Management is down, and
-// the CLI's own backoff resolves the outage on its own once the daemon reports
-// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
-// because Management happened to be restarting when the daemon dialed it.
-func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	unreachable := errors.New("create connection: dial context: context deadline exceeded")
-	attempts := 0
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		attempts++
-		return false, unreachable
-	}
-
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
-	require.Nil(t, resp, "a failed login must not answer with a login response")
-	require.Equal(t, 1, attempts)
-	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"a peer that could not reach Management is not waiting on a login")
-}
-
-// The counterpart: Management refusing the peer's credentials is a decision, and
-// the SSO flow still has to start for it. The profile carries an unusable
-// private key so the flow setup fails immediately instead of dialing, which is
-// enough to show the branch was entered — the refusal itself is never what comes
-// back out.
-func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
-	s, _, _, username, cfgPath := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-	breakProfilePrivateKey(t, cfgPath)
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-
-	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, stateErr)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"the SSO flow setup was never reached with the broken key")
-}
-
-func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	var keysTried []string
-	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
-		keysTried = append(keysTried, setupKey)
-		return "", nil
-	}
-
-	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
-	require.NoError(t, err, "the probe's outcome leaked out as the login result")
-	require.NotNil(t, resp)
-	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
-	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusIdle, status)
-}
-
-// breakProfilePrivateKey replaces the profile's private key with an unparseable
-// one, which makes any attempt to build a Management client fail on the spot.
-func breakProfilePrivateKey(t *testing.T, cfgPath string) {
-	t.Helper()
-
-	raw, err := os.ReadFile(cfgPath)
-	require.NoError(t, err)
-
-	var cfg map[string]any
-	require.NoError(t, json.Unmarshal(raw, &cfg))
-	cfg["PrivateKey"] = "not-a-key"
-
-	patched, err := json.Marshal(cfg)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
-}

client/server/mdm.go

@@ -94,12 +94,12 @@ func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) error {
 	// publishConfigChangedEvent has already fired inside
 	// restartEngineForMDMLocked with source="mdm". Emit an MDM-specific
 	// user-visible toast so the operator knows their IT policy was
-	// applied (UserMessage != "" triggers the GUI notifier).
+	// applied; the message and title keys let the GUI localise it.
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"MDM policy applied",
-		"NetBird configuration was updated by your IT policy.",
+		proto.NewUserMessage(proto.UserMsgMDMPolicyApplied).WithTitle(proto.TitleMDMPolicyApplied),
 		map[string]string{
 			proto.MetadataSourceKey: proto.MetadataSourceMDM,
 			proto.MetadataTypeKey:   proto.MetadataTypePolicyApplied,
@@ -126,7 +126,7 @@ func (s *Server) publishConfigChangedEvent(source string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		fmt.Sprintf("daemon config changed (source=%s)", source),
-		"",
+		nil,
 		map[string]string{
 			proto.MetadataSourceKey: source,
 			proto.MetadataTypeKey:   proto.MetadataTypeConfigChanged,

client/server/network.go

@@ -170,7 +170,7 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network selection changed",
-		"",
+		nil,
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -214,7 +214,7 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network deselection changed",
-		"",
+		nil,
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -232,4 +232,3 @@ func toNetIDs(routes []string) []route.NetID {
 	}
 	return netIDs
 }
-

client/server/server.go

@@ -135,13 +135,6 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
-
-	// loginAttemptFn stands in for the Management login round trip. Tests set
-	// it to drive the login outcomes that need a server on the other end;
-	// production leaves it nil, and every login goes through loginAttempt.
-	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
-
-	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
@@ -377,34 +370,7 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// attemptLogin runs a login round trip against Management, or the stand-in a
-// test installed in place of it.
-func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
-	if s.loginAttemptFn != nil {
-		return s.loginAttemptFn(ctx, setupKey, jwtToken)
-	}
-	return s.loginAttempt(ctx, setupKey, jwtToken)
-}
-
-func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
-	if s.isLoginRequiredFn != nil {
-		return s.isLoginRequiredFn(ctx)
-	}
-
-	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
-	if err != nil {
-		log.Errorf("failed to create auth client: %v", err)
-		return false, err
-	}
-	defer authClient.Close()
-
-	return authClient.IsLoginRequired(ctx)
-}
-
-// loginAttempt attempts to login using the provided information. It returns
-// StatusNeedsLogin when Management refused the peer's credentials and
-// StatusLoginFailed for every other failure, so callers can tell an
-// authentication decision apart from a login that never got made.
+// loginAttempt attempts to login using the provided information. it returns a status in case something fails
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -657,19 +623,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	// A probe that errors leaves the login undecided: Management unreachable, a
-	// restart mid-request, an internal error. Those are returned for the caller
-	// to retry, because turning them into an SSO prompt asks the user to solve
-	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway. Only Management refusing the
-	// peer's key is a decision, and IsLoginRequired reports that as
-	// needsLogin=true rather than an error.
-	needsLogin, err := s.isLoginRequired(ctx)
-	if err != nil {
-		state.Set(internal.StatusLoginFailed)
-		return nil, err
-	}
-	if !needsLogin {
+	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
@@ -730,7 +684,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -885,7 +839,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -1815,9 +1769,6 @@ func (s *Server) RequestExtendAuthSession(
 	if connectClient == nil {
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
 	}
-	if connectClient.Engine() == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
-	}
 
 	hint := ""
 	if msg.Hint != nil {
@@ -2230,7 +2181,7 @@ func (s *Server) publishProfileListChanged(profileName string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Profile list changed",
-		"",
+		nil,
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindProfileListChanged, proto.MetadataProfileKey: profileName},
 	)
 }
@@ -2249,7 +2200,7 @@ func (s *Server) publishLogLevelChanged(level string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Log level changed",
-		"",
+		nil,
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
 	)
 }

client/ui/build/linux/netbird-ui.desktop

@@ -1,11 +1,10 @@
 [Desktop Entry]
 Type=Application
-Name=NetBird
-Comment=NetBird desktop client
+Name=netbird-ui
 Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 netbird-ui
 Icon=netbird-ui
-Categories=Utility;Network;
+Categories=Development;
 Terminal=false
-Keywords=netbird;vpn;wireguard;
+Keywords=wails
 Version=1.0
 StartupNotify=false

client/ui/build/linux/netbird.desktop

@@ -1,6 +1,5 @@
 [Desktop Entry]
-Name=NetBird
-Comment=NetBird desktop client
+Name=Netbird
 Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/netbird-ui
 Icon=netbird
 Type=Application

client/ui/build/linux/nfpm/nfpm.yaml

@@ -21,31 +21,22 @@ contents:
     dst: "/usr/local/bin/netbird-ui"
   - src: "./build/appicon.png"
     dst: "/usr/share/icons/hicolor/128x128/apps/netbird-ui.png"
-  # The name the polkit action's icon_name refers to, which the released packages
-  # install as /usr/share/pixmaps/netbird.png.
-  - src: "./build/appicon.png"
-    dst: "/usr/share/icons/hicolor/128x128/apps/netbird.png"
   - src: "./build/linux/netbird-ui.desktop"
     dst: "/usr/share/applications/netbird-ui.desktop"
-  # Names the polkit action for the elevation prompt the app raises when an
-  # unprivileged user changes a privileged setting; without it the dialog shows a
-  # raw command line.
-  - src: "./build/linux/polkit/io.netbird.settings.policy"
-    dst: "/usr/share/polkit-1/actions/io.netbird.settings.policy"
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:
-  - libgtk-4-1 (>= 4.14)
+  - libgtk-4-1
   - libwebkitgtk-6.0-4
   - xdg-utils
 
 # Distribution-specific overrides for different package formats
 overrides:
-  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
   rpm:
     depends:
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - gtk4
+      - webkitgtk6.0
       - xdg-utils
 
   # Arch Linux packages

client/ui/build/linux/polkit/io.netbird.settings.policy

@@ -1,47 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
- "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
-
-<!--
-  Names the action behind the elevation prompt the desktop app raises for an SSH
-  setting the daemon restricts to root; without it pkexec's generic dialog offers
-  the raw command line instead. The argv1 annotation keeps this wording to the
-  one-shot mode that applies those settings.
-
-  auth_admin rather than auth_admin_keep: each of these settings is its own grant
-  of shell access, so a credential cache would let a second, unasked-for change
-  ride along on the authorization given the first.
-
-  exec.path takes no wildcard and the binary's location depends on the package,
-  hence one action per path.
--->
-<policyconfig>
-  <vendor>NetBird</vendor>
-  <vendor_url>https://netbird.io</vendor_url>
-
-  <action id="io.netbird.settings.apply-privileged">
-    <description>Change privileged NetBird settings</description>
-    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
-    <icon_name>netbird</icon_name>
-    <defaults>
-      <allow_any>auth_admin</allow_any>
-      <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/netbird-ui</annotate>
-    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
-  </action>
-
-  <action id="io.netbird.settings.apply-privileged-local">
-    <description>Change privileged NetBird settings</description>
-    <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
-    <icon_name>netbird</icon_name>
-    <defaults>
-      <allow_any>auth_admin</allow_any>
-      <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/netbird-ui</annotate>
-    <annotate key="org.freedesktop.policykit.exec.argv1">--apply-privileged-settings</annotate>
-  </action>
-</policyconfig>

client/ui/frontend/src/contexts/SettingsContext.tsx

@@ -22,18 +22,12 @@ const logSaveError = (err: unknown) => console.error("[SettingsContext] save fai
 
 export type AutostartState = { supported: boolean; enabled: boolean };
 
-// GuardedField is a setting the daemon only accepts from root/administrator.
-// Turning one on goes through saveGuardedField, which asks the operating system
-// for the privileges rather than sending a request that would be refused.
-export type GuardedField = "serverSshAllowed" | "enableSshRoot" | "disableSshAuth";
-
 type SettingsContextValue = {
     config: Config;
     guiVersion: string;
     setField: <K extends keyof Config>(k: K, v: Config[K]) => void;
     saveField: <K extends keyof Config>(k: K, v: Config[K]) => Promise<void>;
     saveFields: (partial: Partial<Config>, opts?: { preSharedKey?: string }) => Promise<void>;
-    saveGuardedField: (k: GuardedField, v: boolean) => Promise<void>;
     saveNow: () => Promise<void>;
 };
 
@@ -69,12 +63,6 @@ const useSettingsState = () => {
     const [guiVersion, setGuiVersion] = useState<string>("—");
     const saveTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
     const loadedRef = useRef<LoadedConfig | null>(null);
-    // Set when the daemon's config changed while a save was pending, so the read
-    // that was skipped to protect the pending edit happens once it is through.
-    // Without it the form keeps values the daemon no longer has and the next save
-    // submits them, which for a guarded setting means asking the user to authorize
-    // a change they never made.
-    const reloadOwed = useRef(false);
 
     useEffect(() => {
         loadedRef.current = loaded;
@@ -85,7 +73,6 @@ const useSettingsState = () => {
     // update the daemon then rejected.
     const reload = useCallback(
         async (profileName: string) => {
-            reloadOwed.current = false;
             try {
                 const data = await SettingsSvc.GetConfig({ profileName, username });
                 setLoaded({ profileName, data });
@@ -107,12 +94,7 @@ const useSettingsState = () => {
                     username,
                 });
                 if (cancelled) return;
-                // A pending edit outranks the daemon's copy until it is saved, so
-                // the read is owed rather than dropped: see reloadOwed.
-                if (saveTimer.current) {
-                    reloadOwed.current = true;
-                    return;
-                }
+                if (saveTimer.current) return;
                 setLoaded({ profileName: activeProfileId, data });
             } catch (e) {
                 if (cancelled || !showError) return;
@@ -159,17 +141,12 @@ const useSettingsState = () => {
         async (profileName: string, next: Config, preSharedKey?: string) => {
             const preSharedKeyWrite = preSharedKey === undefined ? {} : { preSharedKey };
             try {
-                const { declined } = await SettingsSvc.SetConfig({
+                await SettingsSvc.SetConfig({
                     ...next,
                     ...preSharedKeyWrite,
                     profileName,
                     username,
                 });
-                // The change needed authorization and the user said no, so the
-                // optimistic update is wrong. Nothing to report: they know.
-                if (declined || reloadOwed.current) {
-                    await reload(profileName);
-                }
             } catch (e) {
                 // The optimistic update is wrong now: the daemon refused it
                 // (a change that needs elevated privileges, an MDM-managed
@@ -229,59 +206,6 @@ const useSettingsState = () => {
         [loaded, save],
     );
 
-    // saveGuardedField applies a setting the daemon restricts to
-    // root/administrator by having the Go side run the app again under the
-    // platform's elevation prompt (UAC, the macOS authentication dialog, polkit).
-    // The prompt is the user's, so the call is made straight from their gesture
-    // and never from the debounce.
-    const saveGuardedField = useCallback(
-        async (k: GuardedField, v: boolean) => {
-            const cur = loadedRef.current;
-            if (!cur) return;
-
-            // Flush what the debounce still owes, before the optimistic update
-            // below joins it: a later save carrying the guarded value would be
-            // refused, and its error dialog would be the second one for a change
-            // the user already authorized.
-            if (saveTimer.current) {
-                clearTimeout(saveTimer.current);
-                saveTimer.current = null;
-                await save(cur.profileName, cur.data);
-            }
-
-            const next: LoadedConfig = {
-                profileName: cur.profileName,
-                data: { ...cur.data, [k]: v },
-            };
-            loadedRef.current = next;
-            setLoaded(next);
-
-            try {
-                await SettingsSvc.SetGuardedSettings({
-                    profileName: cur.profileName,
-                    username,
-                    [k]: v,
-                });
-            } catch (e) {
-                // The daemon is authoritative either way, so re-read before
-                // reporting. A declined prompt is not an error and does not come
-                // through here at all; this is a prompt that could not be raised,
-                // which carries the command that would have done it.
-                await reload(cur.profileName);
-                await errorDialog({
-                    Title: i18next.t("settings.error.saveTitle"),
-                    Message: errorMessage(e),
-                    Command: errorCommand(e),
-                });
-                return;
-            }
-            // Either the change went through or the user declined it. The daemon
-            // says which.
-            await reload(cur.profileName);
-        },
-        [username, save, reload],
-    );
-
     const saveFields = useCallback(
         async (partial: Partial<Config>, opts?: { preSharedKey?: string }) => {
             if (!loaded) return;
@@ -301,27 +225,15 @@ const useSettingsState = () => {
         [loaded, save],
     );
 
-    return {
-        config: loaded?.data ?? null,
-        guiVersion,
-        setField,
-        saveField,
-        saveFields,
-        saveGuardedField,
-        saveNow,
-    };
+    return { config: loaded?.data ?? null, guiVersion, setField, saveField, saveFields, saveNow };
 };
 
 export const SettingsProvider = ({ children }: { children: ReactNode }) => {
-    const { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow } =
-        useSettingsState();
+    const { config, guiVersion, setField, saveField, saveFields, saveNow } = useSettingsState();
 
     const value = useMemo<SettingsContextValue | null>(
-        () =>
-            config
-                ? { config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow }
-                : null,
-        [config, guiVersion, setField, saveField, saveFields, saveGuardedField, saveNow],
+        () => (config ? { config, guiVersion, setField, saveField, saveFields, saveNow } : null),
+        [config, guiVersion, setField, saveField, saveFields, saveNow],
     );
 
     if (!value) {

client/ui/frontend/src/hooks/usePrivilege.ts

@@ -1,6 +1,6 @@
 import { useEffect, useState } from "react";
 import { Settings as SettingsSvc } from "@bindings/services";
-import { type Privilege } from "@bindings/services/models.js";
+import { Privilege } from "@bindings/services/models.js";
 
 // usePrivilege reports whether this UI process may perform the changes the daemon
 // restricts to root/administrator. It is answered in-process from our own token

client/ui/frontend/src/lib/connection.ts

@@ -43,12 +43,7 @@ function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<v
 }
 
 async function runSsoLogin(
-    result: {
-        verificationUri: string;
-        verificationUriComplete: string;
-        userCode: string;
-        profileId: string;
-    },
+    result: { verificationUri: string; verificationUriComplete: string; userCode: string },
     state: SsoState,
     signal?: AbortSignal,
 ): Promise<void> {
@@ -61,7 +56,7 @@ async function runSsoLogin(
     // suspended, so a frontend-driven Up (a promise continuation) would not
     // fire until the user woke the window (e.g. hovering the tray icon).
     const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "", profileId: result.profileId },
+        { userCode: result.userCode, hostname: "" },
         { profileName: "", username: "" },
     );
 

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -11,7 +11,7 @@ import { DialogHeading } from "@/components/dialog/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
 import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
+import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
 import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
 import { formatRemaining } from "@/lib/formatters";
 
@@ -131,21 +131,6 @@ export default function SessionExpirationDialog() {
         }
     }, [busy, t]);
 
-    const authenticate = useCallback(async () => {
-        if (busy) return;
-        setBusy(true);
-        try {
-            await Events.Emit(EVENT_TRIGGER_LOGIN);
-            await WindowManager.CloseSessionExpiration();
-        } catch (e) {
-            setBusy(false);
-            await errorDialog({
-                Title: t("connect.error.loginTitle"),
-                Message: formatErrorMessage(e),
-            });
-        }
-    }, [busy, t]);
-
     const logout = useCallback(async () => {
         if (busy) return;
         setBusy(true);
@@ -200,7 +185,7 @@ export default function SessionExpirationDialog() {
                     variant={"primary"}
                     size={"md"}
                     className={"w-full"}
-                    onClick={expired ? authenticate : stay}
+                    onClick={stay}
                     disabled={busy}
                 >
                     {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}

client/ui/frontend/src/modules/settings/SettingsSSH.tsx

@@ -1,4 +1,3 @@
-import { type TFunction } from "i18next";
 import { useTranslation } from "react-i18next";
 import { CopyToClipboard } from "@/components/CopyToClipboard";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
@@ -7,91 +6,51 @@ import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { cn } from "@/lib/cn";
 import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
-import { type GuardedField, useSettings } from "@/contexts/SettingsContext.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
 import { usePrivilege } from "@/hooks/usePrivilege.ts";
-import type { Privilege } from "@bindings/services/models.js";
+import { Privilege } from "@bindings/services/models.js";
 import { type ChangeEvent, type ReactNode, useEffect, useId, useState } from "react";
 
 export function SettingsSSH() {
     const { t } = useTranslation();
-    const { config, setField, saveGuardedField } = useSettings();
+    const { config, setField } = useSettings();
     const privilege = usePrivilege();
-    // The field whose elevation prompt is currently up, if any. The prompt is
-    // modal to the operating system, not to us, so the guarded controls are held
-    // still meanwhile rather than allowed to stack a second one behind it.
-    const [authorizing, setAuthorizing] = useState<GuardedField | null>(null);
     const isSSHServerEnabled = config.serverSshAllowed;
 
-    const authorize = async (field: GuardedField, value: boolean) => {
-        setAuthorizing(field);
-        try {
-            await saveGuardedField(field, value);
-        } finally {
-            setAuthorizing(null);
-        }
-    };
-
     // The daemon restricts only the direction that hands out shells from a process
-    // running as root: for all three settings that is switching the field on.
-    //
-    // An unprivileged user gets that direction routed through the platform's
-    // elevation prompt where there is one to raise, and otherwise the old
-    // arrangement, where the control is either unavailable (it is off and only a
-    // privileged caller could turn it on) or a one-way switch (it is on, they may
-    // turn it off but not back on) with the command that does it.
+    // running as root. So for an unprivileged user a guarded control is either
+    // unavailable (it is off and only they could turn it on) or a one-way switch
+    // (it is on, they may turn it off, but not back on) — say which, either way.
     //
     // A null privilege means we could not determine it: leave the control alone
     // rather than greying it out with nothing to explain why. The daemon enforces
     // this regardless, and a rejected save reports its own guidance.
     const guarded = (
-        field: GuardedField,
+        guardedDirectionActive: boolean,
         command: (p: Privilege) => string,
         // inverted marks a control whose guarded direction is switching it off, so
         // the one-way warning has to read the other way round.
         inverted = false,
     ) => {
-        const plain = (value: boolean) => setField(field, value);
         if (!privilege || privilege.privileged) {
-            return { apply: plain, disabled: false, hint: undefined };
+            return { disabled: false, hint: undefined };
         }
-
-        const guardedDirectionActive = config[field];
-        const hint = (pending: boolean, command?: string) => (
-            <GuardedHint
-                actor={actorLabel(privilege, t)}
+        const hint = (
+            <PrivilegeHint
+                actor={privilege.actor}
+                command={command(privilege)}
                 oneWay={guardedDirectionActive}
                 inverted={inverted}
-                pending={pending}
-                command={command}
             />
         );
-
-        if (privilege.canElevate) {
-            return {
-                // Switching off is ours to do; only switching on is authorized.
-                apply: (value: boolean) => {
-                    if (!value) {
-                        plain(value);
-                        return;
-                    }
-                    void authorize(field, value);
-                },
-                disabled: authorizing !== null,
-                hint: hint(authorizing === field),
-            };
-        }
-        return {
-            apply: plain,
-            disabled: !guardedDirectionActive,
-            hint: hint(false, command(privilege)),
-        };
+        return { disabled: !guardedDirectionActive, hint };
     };
 
-    const sshServer = guarded("serverSshAllowed", (p) => p.allowSshServer);
-    const sshRoot = guarded("enableSshRoot", (p) => p.enableSshRoot);
+    const sshServer = guarded(config.serverSshAllowed, (p) => p.allowSshServer);
+    const sshRoot = guarded(config.enableSshRoot, (p) => p.enableSshRoot);
     // Inverted control: the guarded direction is switching authentication off, so
     // it is the already-disabled state that is the one-way one.
-    const sshAuth = guarded("disableSshAuth", (p) => p.disableSshAuth, true);
+    const sshAuth = guarded(config.disableSshAuth, (p) => p.disableSshAuth, true);
     const jwtTtlId = useId();
     const [jwtTtlInput, setJwtTtlInput] = useState(String(config.sshJwtCacheTtl));
 
@@ -125,7 +84,7 @@ export function SettingsSSH() {
             <SectionGroup title={t("settings.ssh.section.server")}>
                 <FancyToggleSwitch
                     value={config.serverSshAllowed}
-                    onChange={sshServer.apply}
+                    onChange={(v) => setField("serverSshAllowed", v)}
                     disabled={sshServer.disabled}
                     label={t("settings.ssh.server.label")}
                     helpText={t("settings.ssh.server.help")}
@@ -139,7 +98,7 @@ export function SettingsSSH() {
             >
                 <FancyToggleSwitch
                     value={config.enableSshRoot}
-                    onChange={sshRoot.apply}
+                    onChange={(v) => setField("enableSshRoot", v)}
                     disabled={sshRoot.disabled}
                     label={t("settings.ssh.root.label")}
                     helpText={t("settings.ssh.root.help")}
@@ -171,7 +130,7 @@ export function SettingsSSH() {
             >
                 <FancyToggleSwitch
                     value={!config.disableSshAuth}
-                    onChange={(v) => sshAuth.apply(!v)}
+                    onChange={(v) => setField("disableSshAuth", !v)}
                     disabled={sshAuth.disabled}
                     label={t("settings.ssh.jwt.label")}
                     helpText={t("settings.ssh.jwt.help")}
@@ -204,81 +163,41 @@ export function SettingsSSH() {
     );
 }
 
-// actorLabel names the principal the daemon requires, in the user's language. The
-// Go side reports which one it is rather than wording it, because "administrator
-// privileges" is English and a translated sentence cannot borrow it.
-function actorLabel(privilege: Privilege, t: TFunction): string {
-    return privilege.actorKey === "administrator"
-        ? t("settings.ssh.privilege.actorAdministrator")
-        : t("settings.ssh.privilege.actorRoot");
-}
-
-// GuardedHint is what a control the daemon guards says to an unprivileged user.
-// There are three things worth saying, and it says at most one:
-//
-//   - A prompt is open. Worth a line because it can take a few seconds to appear,
-//     long enough that a control which merely went inert would read as a hang.
-//   - The setting is in its guarded state already (oneWay), so the user may switch
-//     it back as they please and it is switching it away again that will ask. No
-//     command either way: the direction they can take is theirs to take.
-//   - Only a privileged caller can move it at all, and there is no prompt to
-//     raise: the command that does it belongs here, and nothing else will do.
-//
-// Which leaves the case of a control whose guarded direction is still ahead of the
-// user and a prompt that can be raised for it: nothing to say, because clicking it
-// raises the prompt and the prompt explains itself.
-function GuardedHint({
+// PrivilegeHint explains what an unprivileged user can and cannot do with a
+// guarded control, and offers the command that does it with the privileges the
+// daemon requires. oneWay covers the control being in the guarded state already:
+// switching it back is the part that needs privileges.
+function PrivilegeHint({
     actor,
+    command,
     oneWay,
     inverted,
-    pending,
-    command,
 }: {
     actor: string;
+    command: string;
     oneWay: boolean;
     inverted: boolean;
-    pending: boolean;
-    command?: string;
 }): ReactNode {
     const { t } = useTranslation();
-
-    if (pending) {
-        return <HintBox>{t("settings.ssh.privilege.authorizePending")}</HintBox>;
-    }
-    if (oneWay) {
-        return (
-            <HintBox>
-                <span>
-                    {inverted
-                        ? t("settings.ssh.privilege.oneWayInverted", { actor })
-                        : t("settings.ssh.privilege.oneWay", { actor })}
-                </span>
-            </HintBox>
-        );
-    }
     if (!command) return null;
-    return (
-        <HintBox>
-            <span>{t("settings.ssh.privilege.hint", { actor })}</span>
-            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
-                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
-                    {command}
-                </code>
-            </CopyToClipboard>
-        </HintBox>
-    );
-}
-
-// HintBox is the box a guarded control puts its explanation in, directly under the
-// control it belongs to.
-function HintBox({ children }: { children: ReactNode }): ReactNode {
     return (
         <div
             className={
                 "-mt-2 flex flex-col gap-1 rounded-md bg-nb-gray-930 px-3 py-2 text-xs text-nb-gray-300"
             }
         >
-            {children}
+            <span>
+                {!oneWay
+                    ? t("settings.ssh.privilege.hint", { actor })
+                    : inverted
+                      ? t("settings.ssh.privilege.oneWayInverted", { actor })
+                      : t("settings.ssh.privilege.oneWay", { actor })}
+            </span>
+            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
+                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
+                    {command}
+                </code>
+            </CopyToClipboard>
         </div>
     );
 }

client/ui/i18n/TRANSLATING.md

@@ -40,6 +40,12 @@ i18n/locales/<code>/common.json  a target — message only
 
 Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
 
+The `event.*` keys are a special group: the background service names them when it
+publishes a notification, and the app looks them up here. Their names are part of
+a Go↔JSON contract (`client/proto/usermsg.go`), so they are even less renameable
+than the rest — and a missing one shows the user English. Tests fail the build if
+any locale drops one.
+
 | ✅ Do | ❌ Don't |
 |---|---|
 | Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |

client/ui/i18n/bundle.go

@@ -126,18 +126,29 @@ func (b *Bundle) BundleFor(code LanguageCode) (map[string]string, error) {
 // pairs ("version", "1.2.3" replaces "{version}"). Unknown keys fall back to
 // the default language, then to the key itself so a miss is visible in the UI.
 func (b *Bundle) Translate(lang LanguageCode, key string, args ...string) string {
+	if v, ok := b.Lookup(lang, key, args...); ok {
+		return v
+	}
+	return key
+}
+
+// Lookup resolves key like Translate but reports whether it was found in the
+// requested or the default bundle. Callers holding a better fallback than the
+// raw key — a daemon-supplied English string for a key this build predates —
+// use this to tell a miss from a hit.
+func (b *Bundle) Lookup(lang LanguageCode, key string, args ...string) (string, bool) {
 	b.mu.RLock()
 	defer b.mu.RUnlock()
 
 	if v, ok := b.bundles[lang][key]; ok {
-		return applyPlaceholders(v, args)
+		return applyPlaceholders(v, args), true
 	}
 	if lang != DefaultLanguage {
 		if v, ok := b.bundles[DefaultLanguage][key]; ok {
-			return applyPlaceholders(v, args)
+			return applyPlaceholders(v, args), true
 		}
 	}
-	return key
+	return "", false
 }
 
 // applyPlaceholders substitutes {name} in s using args as flat name/value

client/ui/i18n/eventkeys_test.go

@@ -0,0 +1,126 @@
+//go:build !android && !ios && !freebsd && !js
+
+package i18n
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// shippedBundle loads the real locale tree rather than the fstest fixture the
+// other tests use: these checks exist to catch a key the daemon publishes but no
+// bundle translates, which only the shipped files can prove.
+func shippedBundle(t *testing.T) *Bundle {
+	t.Helper()
+	b, err := NewBundle(os.DirFS("locales"))
+	require.NoError(t, err, "the shipped locale tree must load")
+	return b
+}
+
+// The daemon publishes a message key and each UI resolves it locally, so a key
+// with no en entry degrades to the daemon's English fallback and silently stops
+// being translatable. Fail the build instead.
+func TestUserMessageKeysExistInEnglishBundle(t *testing.T) {
+	b := shippedBundle(t)
+
+	for key, text := range proto.UserMessageTexts {
+		got, ok := b.Lookup(DefaultLanguage, string(key))
+		if !assert.True(t, ok, "message key %q has no en translation", key) {
+			continue
+		}
+		assert.Equal(t, text, got,
+			"en translation of %q must match the daemon's English fallback", key)
+	}
+}
+
+func TestUserMessageTitleKeysExistInEnglishBundle(t *testing.T) {
+	b := shippedBundle(t)
+
+	for _, key := range proto.UserMessageTitleKeys {
+		_, ok := b.Lookup(DefaultLanguage, string(key))
+		assert.True(t, ok, "title key %q has no en translation", key)
+	}
+}
+
+// Every shipped locale must translate the daemon's keys, not just en. A missing
+// one still renders (Lookup falls back to en) but the notification would show up
+// in English for that user, which is the bug this whole mechanism exists to fix.
+func TestUserMessageKeysTranslatedInEveryLanguage(t *testing.T) {
+	b := shippedBundle(t)
+
+	keys := make([]proto.UserMessageKey, 0, len(proto.UserMessageTexts))
+	for key := range proto.UserMessageTexts {
+		keys = append(keys, key)
+	}
+	keys = append(keys, proto.UserMessageTitleKeys...)
+
+	for _, lang := range b.Languages() {
+		bundle, err := b.BundleFor(lang.Code)
+		require.NoError(t, err, "BundleFor(%q)", lang.Code)
+
+		for _, key := range keys {
+			text, ok := bundle[string(key)]
+			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
+				continue
+			}
+			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
+		}
+	}
+}
+
+// The tray composes a title from these when an event carries no title key, so a
+// gap here would render "event.severity.warning: DNS" to the user.
+func TestEventTitleKeysTranslatedInEveryLanguage(t *testing.T) {
+	b := shippedBundle(t)
+
+	keys := []string{
+		"event.title",
+		"event.severity.info", "event.severity.warning",
+		"event.severity.error", "event.severity.critical",
+		"event.category.network", "event.category.dns",
+		"event.category.authentication", "event.category.connectivity",
+		"event.category.system",
+	}
+
+	for _, lang := range b.Languages() {
+		bundle, err := b.BundleFor(lang.Code)
+		require.NoError(t, err, "BundleFor(%q)", lang.Code)
+
+		for _, key := range keys {
+			text, ok := bundle[key]
+			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
+				continue
+			}
+			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
+		}
+	}
+
+	// The composed title is useless without both slots.
+	title, ok := b.Lookup(DefaultLanguage, "event.title", "severity", "Warning", "category", "DNS")
+	require.True(t, ok)
+	assert.Equal(t, "Warning: DNS", title, "event.title must substitute both placeholders")
+}
+
+func TestBundleLookupReportsMisses(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	got, ok := b.Lookup("en", "tray.menu.connect")
+	assert.True(t, ok)
+	assert.Equal(t, "Connect", got)
+
+	// An absent key must report a miss rather than echo the key, so callers can
+	// substitute their own fallback.
+	got, ok = b.Lookup("en", "tray.missing")
+	assert.False(t, ok, "unknown key must report a miss")
+	assert.Empty(t, got, "a miss must not return the key")
+
+	// Empty keys reach Lookup from events that carry no title key at all.
+	_, ok = b.Lookup("en", "")
+	assert.False(t, ok, "empty key must report a miss")
+}

client/ui/i18n/locales/de/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Warnung"
+    },
+    "event.severity.error": {
+        "message": "Fehler"
+    },
+    "event.severity.critical": {
+        "message": "Kritisch"
+    },
+    "event.category.network": {
+        "message": "Netzwerk"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Authentifizierung"
+    },
+    "event.category.connectivity": {
+        "message": "Konnektivität"
+    },
+    "event.category.system": {
+        "message": "System"
+    },
+    "event.panic": {
+        "message": "Der NetBird-Dienst ist abgestürzt. Bitte starten Sie den Dienst neu und senden Sie einen Fehlerbericht mit den Client-Protokollen."
+    },
+    "event.dns.recovered": {
+        "message": "DNS-Server sind wieder erreichbar."
+    },
+    "event.dns.unreachable": {
+        "message": "Ein oder mehrere DNS-Server sind nicht erreichbar. Das kann die Verbindung zu einigen Diensten beeinträchtigen."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit Node verbunden."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit Node getrennt."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Verbindung zum Exit Node verloren. Ihr Internetzugang kann beeinträchtigt sein."
+    },
+    "event.exitNode.haChange": {
+        "message": "Exit Node aufgrund einer Änderung der Hochverfügbarkeit getrennt."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Exit Node aus unbekannten Gründen getrennt."
+    },
+    "event.update.installing": {
+        "message": "Update wird jetzt installiert."
+    },
+    "event.update.completed": {
+        "message": "Ihr NetBird-Client wurde automatisch auf Version {version} aktualisiert."
+    },
+    "event.update.failed": {
+        "message": "Automatisches Update fehlgeschlagen: {reason}"
+    },
     "common.cancel": {
         "message": "Abbrechen"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Alle sichtbaren Ressourcen umschalten"
     },
+    "settings.nav.label": {
+        "message": "Einstellungsbereiche"
+    },
     "profile.switch.title": {
         "message": "Zu Profil \"{name}\" wechseln?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Debug-Paket fehlgeschlagen"
     },
-    "settings.nav.label": {
-        "message": "Einstellungsbereiche"
-    },
     "settings.tabs.general": {
         "message": "Allgemein"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird konnte auf diesem System nicht die nötigen Rechte anfordern. Führen Sie stattdessen dies aus:"
-    },
-    "error.elevation_failed": {
-        "message": "Die Änderung konnte mit erhöhten Rechten nicht angewendet werden. Führen Sie stattdessen dies aus:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root-Rechte"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "Administratorrechte"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Sie können dies deaktivieren, zum erneuten Aktivieren sind {actor} erforderlich."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Sie können dies aktivieren, zum erneuten Deaktivieren sind {actor} erforderlich."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Warten auf Autorisierung…"
     }
 }

client/ui/i18n/locales/en/common.json

@@ -239,6 +239,90 @@
         "message": "Your NetBird configuration was updated by your IT policy.",
         "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
     },
+    "event.title": {
+        "message": "{severity}: {category}",
+        "description": "Notification title for a daemon event, composed from severity and category, e.g. \"Warning: DNS\". Keep both placeholders; use your locale's colon spacing."
+    },
+    "event.severity.info": {
+        "message": "Info",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.warning": {
+        "message": "Warning",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.error": {
+        "message": "Error",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.critical": {
+        "message": "Critical",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.category.network": {
+        "message": "Network",
+        "description": "Event category label used in the {category} slot of event.title. Refers to the overlay network."
+    },
+    "event.category.dns": {
+        "message": "DNS",
+        "description": "Event category label used in the {category} slot of event.title. Acronym, do not translate."
+    },
+    "event.category.authentication": {
+        "message": "Authentication",
+        "description": "Event category label used in the {category} slot of event.title. Refers to signing in to the management server."
+    },
+    "event.category.connectivity": {
+        "message": "Connectivity",
+        "description": "Event category label used in the {category} slot of event.title. Refers to reaching peers."
+    },
+    "event.category.system": {
+        "message": "System",
+        "description": "Event category label used in the {category} slot of event.title. Refers to the local machine and the NetBird service."
+    },
+    "event.panic": {
+        "message": "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
+        "description": "Notification body after the NetBird background service crashed. \"Service\" is the daemon, not a remote service."
+    },
+    "event.dns.recovered": {
+        "message": "DNS servers are reachable again.",
+        "description": "Notification body when previously unreachable upstream DNS servers respond again."
+    },
+    "event.dns.unreachable": {
+        "message": "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+        "description": "Notification body when one or more upstream DNS servers stop responding."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit node connected.",
+        "description": "Notification body when a full-tunnel exit node becomes active."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit node disconnected.",
+        "description": "Notification body when the user or the client shuts the exit node down deliberately."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Exit node connection lost. Your internet access might be affected.",
+        "description": "Notification body when the exit node peer became unreachable. \"Internet access\" means the user's own browsing."
+    },
+    "event.exitNode.haChange": {
+        "message": "Exit node disconnected due to high availability change.",
+        "description": "Notification body when a high-availability group switched away from this exit node. High availability is the standard IT term."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Exit node disconnected for unknown reasons.",
+        "description": "Notification body when the exit node dropped for a reason the client could not classify."
+    },
+    "event.update.installing": {
+        "message": "Installing update now.",
+        "description": "Notification body shown as an automatic client update starts installing."
+    },
+    "event.update.completed": {
+        "message": "Your NetBird client was auto-updated to version {version}.",
+        "description": "Notification body after an automatic client update succeeded. {version} is a version number, keep verbatim."
+    },
+    "event.update.failed": {
+        "message": "Auto-update failed: {reason}",
+        "description": "Notification body when an automatic client update failed. {reason} is an untranslated technical error string; keep your locale's colon spacing."
+    },
     "common.cancel": {
         "message": "Cancel",
         "description": "Generic Cancel button label, reused across dialogs. Keep short."
@@ -1775,36 +1859,16 @@
         "message": "Operation failed.",
         "description": "Generic fallback error message used when no specific error applies."
     },
-    "error.elevation_unavailable": {
-        "message": "NetBird could not ask this system for the privileges the change needs. Run this instead:",
-        "description": "Error: this computer has no way to prompt for elevated privileges. Followed by a copyable command that applies the setting from a terminal."
-    },
-    "error.elevation_failed": {
-        "message": "The change could not be applied with elevated privileges. Run this instead:",
-        "description": "Error: the authorization succeeded but applying the setting afterwards failed. Followed by a copyable command that applies the setting from a terminal."
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root",
-        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Linux, macOS and BSD, where the daemon requires the root account. 'root' is an account name and stays as it is; add the word for privileges or rights around it if the sentence needs one to read naturally."
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "administrator privileges",
-        "description": "Fills {actor} in the settings.ssh.privilege.* messages on Windows, where the daemon requires an elevated administrator. The Windows term for the rights an account is asked to elevate to."
-    },
     "settings.ssh.privilege.hint": {
         "message": "Requires {actor}. Run this instead:",
         "description": "Help text under an SSH setting the user cannot change: it needs elevated privileges. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     },
     "settings.ssh.privilege.oneWay": {
-        "message": "You can switch this off, but switching it back on needs {actor}.",
-        "description": "Help text under an SSH setting that is already on: an unprivileged user may switch it off freely, and switching it on again is what needs the privileges. No command follows, since the direction they can take is theirs to take. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows."
+        "message": "You can switch this off, but switching it back on needs {actor}:",
+        "description": "Warning under an SSH setting an unprivileged user may disable but not re-enable. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     },
     "settings.ssh.privilege.oneWayInverted": {
-        "message": "You can switch this on, but switching it back off needs {actor}.",
-        "description": "Same as settings.ssh.privilege.oneWay, for the SSH authentication setting once it has been switched off: switching it off again is what needs the privileges."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Waiting for authorization…",
-        "description": "Replaces the help text under a guarded SSH setting while the authorization prompt is open, which can take a few seconds to appear. Keep the trailing ellipsis."
+        "message": "You can switch this on, but switching it back off needs {actor}:",
+        "description": "Warning under the SSH authentication setting, which an unprivileged user may re-enable but not disable again. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
     }
 }

client/ui/i18n/locales/es/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Su configuración de NetBird fue actualizada por su política de TI."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Información"
+    },
+    "event.severity.warning": {
+        "message": "Advertencia"
+    },
+    "event.severity.error": {
+        "message": "Error"
+    },
+    "event.severity.critical": {
+        "message": "Crítico"
+    },
+    "event.category.network": {
+        "message": "Red"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticación"
+    },
+    "event.category.connectivity": {
+        "message": "Conectividad"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "El servicio de NetBird falló de forma inesperada. Reinicie el servicio y envíe un informe de error con los registros del cliente."
+    },
+    "event.dns.recovered": {
+        "message": "Los servidores DNS vuelven a estar accesibles."
+    },
+    "event.dns.unreachable": {
+        "message": "No se puede acceder a uno o más servidores DNS. Esto puede afectar la conexión a algunos servicios."
+    },
+    "event.exitNode.connected": {
+        "message": "Nodo de salida conectado."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nodo de salida desconectado."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Se perdió la conexión con el nodo de salida. Su acceso a Internet puede verse afectado."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nodo de salida desconectado por un cambio de alta disponibilidad."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nodo de salida desconectado por motivos desconocidos."
+    },
+    "event.update.installing": {
+        "message": "Instalando la actualización ahora."
+    },
+    "event.update.completed": {
+        "message": "Su cliente de NetBird se actualizó automáticamente a la versión {version}."
+    },
+    "event.update.failed": {
+        "message": "La actualización automática falló: {reason}"
+    },
     "common.cancel": {
         "message": "Cancelar"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Conmutar todos los recursos visibles"
     },
+    "settings.nav.label": {
+        "message": "Secciones de configuración"
+    },
     "profile.switch.title": {
         "message": "¿Cambiar el perfil a «{name}»?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Error en el paquete de diagnóstico"
     },
-    "settings.nav.label": {
-        "message": "Secciones de configuración"
-    },
     "settings.tabs.general": {
         "message": "General"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "La operación falló."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird no pudo solicitar a este sistema los privilegios necesarios. Ejecute esto en su lugar:"
-    },
-    "error.elevation_failed": {
-        "message": "No se pudo aplicar el cambio con privilegios elevados. Ejecute esto en su lugar:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "privilegios de root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "privilegios de administrador"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Requiere {actor}. Ejecute esto en su lugar:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Esperando la autorización…"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
     },
+    "event.title": {
+        "message": "{severity} : {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Avertissement"
+    },
+    "event.severity.error": {
+        "message": "Erreur"
+    },
+    "event.severity.critical": {
+        "message": "Critique"
+    },
+    "event.category.network": {
+        "message": "Réseau"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Authentification"
+    },
+    "event.category.connectivity": {
+        "message": "Connectivité"
+    },
+    "event.category.system": {
+        "message": "Système"
+    },
+    "event.panic": {
+        "message": "Le service NetBird s'est arrêté brutalement. Veuillez redémarrer le service et envoyer un rapport de bug avec les journaux du client."
+    },
+    "event.dns.recovered": {
+        "message": "Les serveurs DNS sont de nouveau joignables."
+    },
+    "event.dns.unreachable": {
+        "message": "Impossible de joindre un ou plusieurs serveurs DNS. Cela peut affecter la connexion à certains services."
+    },
+    "event.exitNode.connected": {
+        "message": "Nœud de sortie connecté."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nœud de sortie déconnecté."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Connexion au nœud de sortie perdue. Votre accès à Internet peut être affecté."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nœud de sortie déconnecté suite à un changement de haute disponibilité."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nœud de sortie déconnecté pour une raison inconnue."
+    },
+    "event.update.installing": {
+        "message": "Installation de la mise à jour en cours."
+    },
+    "event.update.completed": {
+        "message": "Votre client NetBird a été mis à jour automatiquement vers la version {version}."
+    },
+    "event.update.failed": {
+        "message": "Échec de la mise à jour automatique : {reason}"
+    },
     "common.cancel": {
         "message": "Annuler"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Activer/désactiver toutes les ressources visibles"
     },
+    "settings.nav.label": {
+        "message": "Sections des paramètres"
+    },
     "profile.switch.title": {
         "message": "Basculer vers le profil « {name} » ?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Échec du lot de diagnostic"
     },
-    "settings.nav.label": {
-        "message": "Sections des paramètres"
-    },
     "settings.tabs.general": {
         "message": "Général"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird n’a pas pu demander à ce système les privilèges nécessaires. Exécutez plutôt ceci :"
-    },
-    "error.elevation_failed": {
-        "message": "La modification n’a pas pu être appliquée avec des privilèges élevés. Exécutez plutôt ceci :"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "les privilèges root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "les privilèges administrateur"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "En attente de l’autorisation…"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Információ"
+    },
+    "event.severity.warning": {
+        "message": "Figyelmeztetés"
+    },
+    "event.severity.error": {
+        "message": "Hiba"
+    },
+    "event.severity.critical": {
+        "message": "Kritikus"
+    },
+    "event.category.network": {
+        "message": "Hálózat"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Hitelesítés"
+    },
+    "event.category.connectivity": {
+        "message": "Kapcsolat"
+    },
+    "event.category.system": {
+        "message": "Rendszer"
+    },
+    "event.panic": {
+        "message": "A NetBird szolgáltatás összeomlott. Kérjük, indítsa újra a szolgáltatást, és küldjön hibajelentést a kliens naplóival."
+    },
+    "event.dns.recovered": {
+        "message": "A DNS-kiszolgálók ismét elérhetők."
+    },
+    "event.dns.unreachable": {
+        "message": "Egy vagy több DNS-kiszolgáló nem érhető el. Ez befolyásolhatja egyes szolgáltatások elérését."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit Node csatlakoztatva."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit Node leválasztva."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Megszakadt a kapcsolat az Exit Node-dal. Ez érintheti az internetelérést."
+    },
+    "event.exitNode.haChange": {
+        "message": "Az Exit Node leválasztva a magas rendelkezésre állás változása miatt."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Az Exit Node ismeretlen okból leválasztva."
+    },
+    "event.update.installing": {
+        "message": "A frissítés telepítése folyamatban."
+    },
+    "event.update.completed": {
+        "message": "A NetBird kliens automatikusan a {version} verzióra frissült."
+    },
+    "event.update.failed": {
+        "message": "Az automatikus frissítés sikertelen: {reason}"
+    },
     "common.cancel": {
         "message": "Mégse"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Összes látható erőforrás be/ki"
     },
+    "settings.nav.label": {
+        "message": "Beállítások szakaszai"
+    },
     "profile.switch.title": {
         "message": "Váltás a(z) \"{name}\" profilra?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Hibakeresési csomag sikertelen"
     },
-    "settings.nav.label": {
-        "message": "Beállítások szakaszai"
-    },
     "settings.tabs.general": {
         "message": "Általános"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
-    },
-    "error.elevation_unavailable": {
-        "message": "A NetBird nem tudta bekérni a rendszertől a szükséges jogosultságokat. Futtassa inkább ezt:"
-    },
-    "error.elevation_failed": {
-        "message": "A módosítást emelt szintű jogosultságokkal sem sikerült alkalmazni. Futtassa inkább ezt:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root jogosultság"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "rendszergazdai jogosultság"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Várakozás az engedélyezésre…"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Avviso"
+    },
+    "event.severity.error": {
+        "message": "Errore"
+    },
+    "event.severity.critical": {
+        "message": "Critico"
+    },
+    "event.category.network": {
+        "message": "Rete"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticazione"
+    },
+    "event.category.connectivity": {
+        "message": "Connettività"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "Il servizio NetBird si è arrestato in modo anomalo. Riavvii il servizio e invii una segnalazione di bug con i log del client."
+    },
+    "event.dns.recovered": {
+        "message": "I server DNS sono di nuovo raggiungibili."
+    },
+    "event.dns.unreachable": {
+        "message": "Impossibile raggiungere uno o più server DNS. Questo potrebbe influire sulla connessione ad alcuni servizi."
+    },
+    "event.exitNode.connected": {
+        "message": "Nodo di uscita connesso."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nodo di uscita disconnesso."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Connessione al nodo di uscita perduta. L'accesso a Internet potrebbe essere compromesso."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nodo di uscita disconnesso a causa di una modifica dell'alta disponibilità."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nodo di uscita disconnesso per motivi sconosciuti."
+    },
+    "event.update.installing": {
+        "message": "Installazione dell'aggiornamento in corso."
+    },
+    "event.update.completed": {
+        "message": "Il client NetBird è stato aggiornato automaticamente alla versione {version}."
+    },
+    "event.update.failed": {
+        "message": "Aggiornamento automatico non riuscito: {reason}"
+    },
     "common.cancel": {
         "message": "Annulla"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Attiva/disattiva tutte le risorse visibili"
     },
+    "settings.nav.label": {
+        "message": "Sezioni delle impostazioni"
+    },
     "profile.switch.title": {
         "message": "Passare al profilo «{name}»?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Pacchetto di debug non riuscito"
     },
-    "settings.nav.label": {
-        "message": "Sezioni delle impostazioni"
-    },
     "settings.tabs.general": {
         "message": "Generale"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird non ha potuto richiedere a questo sistema i privilegi necessari. Esegua invece questo:"
-    },
-    "error.elevation_failed": {
-        "message": "Non è stato possibile applicare la modifica con privilegi elevati. Esegua invece questo:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "i privilegi di root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "i privilegi di amministratore"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Richiede {actor}. Esegua invece questo:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "In attesa dell'autorizzazione…"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "NetBird の構成が IT ポリシーによって更新されました。"
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "情報"
+    },
+    "event.severity.warning": {
+        "message": "警告"
+    },
+    "event.severity.error": {
+        "message": "エラー"
+    },
+    "event.severity.critical": {
+        "message": "重大"
+    },
+    "event.category.network": {
+        "message": "ネットワーク"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "認証"
+    },
+    "event.category.connectivity": {
+        "message": "接続"
+    },
+    "event.category.system": {
+        "message": "システム"
+    },
+    "event.panic": {
+        "message": "NetBird サービスがクラッシュしました。サービスを再起動し、クライアントログを添えてバグを報告してください。"
+    },
+    "event.dns.recovered": {
+        "message": "DNS サーバーに再び到達できるようになりました。"
+    },
+    "event.dns.unreachable": {
+        "message": "1 つ以上の DNS サーバーに到達できません。一部のサービスへの接続に影響する可能性があります。"
+    },
+    "event.exitNode.connected": {
+        "message": "出口ノードに接続しました。"
+    },
+    "event.exitNode.disconnected": {
+        "message": "出口ノードの接続を解除しました。"
+    },
+    "event.exitNode.connectionLost": {
+        "message": "出口ノードとの接続が失われました。インターネット接続に影響する可能性があります。"
+    },
+    "event.exitNode.haChange": {
+        "message": "高可用性の変更により出口ノードの接続が解除されました。"
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "不明な理由により出口ノードの接続が解除されました。"
+    },
+    "event.update.installing": {
+        "message": "更新をインストールしています。"
+    },
+    "event.update.completed": {
+        "message": "NetBird クライアントがバージョン {version} に自動更新されました。"
+    },
+    "event.update.failed": {
+        "message": "自動更新に失敗しました: {reason}"
+    },
     "common.cancel": {
         "message": "キャンセル"
     },
@@ -1304,9 +1367,6 @@
     "daemon.outdated.description": {
         "message": "このアプリを使用するには NetBird サービスを更新してください。"
     },
-    "daemon.outdated.download": {
-        "message": "最新版をダウンロード"
-    },
     "error.jwt_clock_skew": {
         "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
     },
@@ -1330,29 +1390,5 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird はこのシステムに必要な権限を要求できませんでした。代わりに次のコマンドを実行してください:"
-    },
-    "error.elevation_failed": {
-        "message": "昇格した権限でも変更を適用できませんでした。代わりに次のコマンドを実行してください:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root 権限"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "管理者権限"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "無効にはできますが、再度有効にするには{actor}が必要です。"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "有効にはできますが、再度無効にするには{actor}が必要です。"
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "承認を待っています…"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "A sua configuração do NetBird foi atualizada pela política de TI."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Informação"
+    },
+    "event.severity.warning": {
+        "message": "Aviso"
+    },
+    "event.severity.error": {
+        "message": "Erro"
+    },
+    "event.severity.critical": {
+        "message": "Crítico"
+    },
+    "event.category.network": {
+        "message": "Rede"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticação"
+    },
+    "event.category.connectivity": {
+        "message": "Conectividade"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "O serviço NetBird falhou de forma inesperada. Reinicie o serviço e envie um relatório de erro com os registros do cliente."
+    },
+    "event.dns.recovered": {
+        "message": "Os servidores DNS estão novamente acessíveis."
+    },
+    "event.dns.unreachable": {
+        "message": "Não é possível acessar um ou mais servidores DNS. Isto pode afetar a conexão a alguns serviços."
+    },
+    "event.exitNode.connected": {
+        "message": "Nó de saída conectado."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nó de saída desconectado."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Conexão com o nó de saída perdida. O seu acesso à Internet pode ser afetado."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nó de saída desconectado devido a uma alteração de alta disponibilidade."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nó de saída desconectado por motivos desconhecidos."
+    },
+    "event.update.installing": {
+        "message": "Instalando a atualização agora."
+    },
+    "event.update.completed": {
+        "message": "O seu cliente NetBird foi atualizado automaticamente para a versão {version}."
+    },
+    "event.update.failed": {
+        "message": "Falha na atualização automática: {reason}"
+    },
     "common.cancel": {
         "message": "Cancelar"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Alternar todos os recursos visíveis"
     },
+    "settings.nav.label": {
+        "message": "Seções das configurações"
+    },
     "profile.switch.title": {
         "message": "Alternar perfil para \"{name}\"?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Falha no pacote de depuração"
     },
-    "settings.nav.label": {
-        "message": "Seções das configurações"
-    },
     "settings.tabs.general": {
         "message": "Geral"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
-    },
-    "error.elevation_unavailable": {
-        "message": "O NetBird não conseguiu solicitar a este sistema os privilégios necessários. Execute isto em vez disso:"
-    },
-    "error.elevation_failed": {
-        "message": "Não foi possível aplicar a alteração com privilégios elevados. Execute isto em vez disso:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "privilégios de root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "privilégios de administrador"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Requer {actor}. Execute isto em vez disso:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Você pode desativar isto, mas ativar novamente requer {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Você pode ativar isto, mas desativar novamente requer {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Aguardando a autorização…"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Информация"
+    },
+    "event.severity.warning": {
+        "message": "Предупреждение"
+    },
+    "event.severity.error": {
+        "message": "Ошибка"
+    },
+    "event.severity.critical": {
+        "message": "Критично"
+    },
+    "event.category.network": {
+        "message": "Сеть"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Аутентификация"
+    },
+    "event.category.connectivity": {
+        "message": "Связь"
+    },
+    "event.category.system": {
+        "message": "Система"
+    },
+    "event.panic": {
+        "message": "Служба NetBird аварийно завершилась. Перезапустите службу и отправьте отчёт об ошибке с журналами клиента."
+    },
+    "event.dns.recovered": {
+        "message": "DNS-серверы снова доступны."
+    },
+    "event.dns.unreachable": {
+        "message": "Не удалось связаться с одним или несколькими DNS-серверами. Это может повлиять на подключение к некоторым сервисам."
+    },
+    "event.exitNode.connected": {
+        "message": "Выходной узел подключён."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Выходной узел отключён."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Соединение с выходным узлом потеряно. Доступ в интернет может быть нарушен."
+    },
+    "event.exitNode.haChange": {
+        "message": "Выходной узел отключён из-за изменения конфигурации высокой доступности."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Выходной узел отключён по неизвестной причине."
+    },
+    "event.update.installing": {
+        "message": "Устанавливается обновление."
+    },
+    "event.update.completed": {
+        "message": "Клиент NetBird автоматически обновлён до версии {version}."
+    },
+    "event.update.failed": {
+        "message": "Не удалось выполнить автоматическое обновление: {reason}"
+    },
     "common.cancel": {
         "message": "Отмена"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "Переключить все видимые ресурсы"
     },
+    "settings.nav.label": {
+        "message": "Разделы настроек"
+    },
     "profile.switch.title": {
         "message": "Переключиться на профиль «{name}»?"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "Не удалось создать отладочный пакет"
     },
-    "settings.nav.label": {
-        "message": "Разделы настроек"
-    },
     "settings.tabs.general": {
         "message": "Общие"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird не смог запросить у этой системы нужные права. Выполните вместо этого:"
-    },
-    "error.elevation_failed": {
-        "message": "Не удалось применить изменение с повышенными правами. Выполните вместо этого:"
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "права root"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "права администратора"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "Требуются {actor}. Выполните вместо этого:"
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "Отключить можно, но чтобы включить снова, нужны {actor}."
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "Включить можно, но чтобы отключить снова, нужны {actor}."
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "Ожидание авторизации…"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "您的 NetBird 配置已根据 IT 策略更新。"
     },
+    "event.title": {
+        "message": "{severity}：{category}"
+    },
+    "event.severity.info": {
+        "message": "信息"
+    },
+    "event.severity.warning": {
+        "message": "警告"
+    },
+    "event.severity.error": {
+        "message": "错误"
+    },
+    "event.severity.critical": {
+        "message": "严重"
+    },
+    "event.category.network": {
+        "message": "网络"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "身份验证"
+    },
+    "event.category.connectivity": {
+        "message": "连接"
+    },
+    "event.category.system": {
+        "message": "系统"
+    },
+    "event.panic": {
+        "message": "NetBird 服务发生崩溃。请重启该服务，并附上客户端日志提交错误报告。"
+    },
+    "event.dns.recovered": {
+        "message": "DNS 服务器已恢复可访问。"
+    },
+    "event.dns.unreachable": {
+        "message": "无法访问一个或多个 DNS 服务器。这可能影响您连接部分服务。"
+    },
+    "event.exitNode.connected": {
+        "message": "出口节点已连接。"
+    },
+    "event.exitNode.disconnected": {
+        "message": "出口节点已断开。"
+    },
+    "event.exitNode.connectionLost": {
+        "message": "与出口节点的连接已丢失。您的互联网访问可能受到影响。"
+    },
+    "event.exitNode.haChange": {
+        "message": "由于高可用性变更，出口节点已断开。"
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "出口节点因未知原因已断开。"
+    },
+    "event.update.installing": {
+        "message": "正在安装更新。"
+    },
+    "event.update.completed": {
+        "message": "NetBird 客户端已自动更新到版本 {version}。"
+    },
+    "event.update.failed": {
+        "message": "自动更新失败：{reason}"
+    },
     "common.cancel": {
         "message": "取消"
     },
@@ -401,6 +464,9 @@
     "networks.bulk.label": {
         "message": "切换所有可见资源"
     },
+    "settings.nav.label": {
+        "message": "设置部分"
+    },
     "profile.switch.title": {
         "message": "切换到配置文件“{name}”？"
     },
@@ -494,9 +560,6 @@
     "settings.error.debugBundleTitle": {
         "message": "创建调试包失败"
     },
-    "settings.nav.label": {
-        "message": "设置部分"
-    },
     "settings.tabs.general": {
         "message": "常规"
     },
@@ -1330,29 +1393,5 @@
     },
     "error.unknown": {
         "message": "操作失败。"
-    },
-    "error.elevation_unavailable": {
-        "message": "NetBird 无法向此系统请求所需的权限。请改为运行："
-    },
-    "error.elevation_failed": {
-        "message": "即使使用提升的权限也无法应用此更改。请改为运行："
-    },
-    "settings.ssh.privilege.actorRoot": {
-        "message": "root 权限"
-    },
-    "settings.ssh.privilege.actorAdministrator": {
-        "message": "管理员权限"
-    },
-    "settings.ssh.privilege.hint": {
-        "message": "需要{actor}。请改为运行："
-    },
-    "settings.ssh.privilege.oneWay": {
-        "message": "您可以关闭此项，但重新开启需要{actor}。"
-    },
-    "settings.ssh.privilege.oneWayInverted": {
-        "message": "您可以开启此项，但再次关闭需要{actor}。"
-    },
-    "settings.ssh.privilege.authorizePending": {
-        "message": "正在等待授权…"
     }
 }

client/ui/localizer.go

@@ -63,6 +63,20 @@ func (l *Localizer) T(key string, args ...string) string {
 	return l.bundle.Translate(lang, key, args...)
 }
 
+// Lookup resolves a key supplied at runtime by the daemon, substituting args as
+// {placeholder}/value pairs. It reports false when the key is in no bundle, so
+// the caller can fall back to the daemon's own English text instead of showing a
+// bare key. An empty key never resolves.
+func (l *Localizer) Lookup(key string, args map[string]string) (string, bool) {
+	if l == nil || l.bundle == nil || key == "" {
+		return "", false
+	}
+	l.mu.RLock()
+	lang := l.lang
+	l.mu.RUnlock()
+	return l.bundle.Lookup(lang, key, flattenArgs(args)...)
+}
+
 // Watch invokes cb on each language change, after the cached language is
 // updated so cb may call l.T with the new locale. Replaces any prior subscription.
 func (l *Localizer) Watch(cb func(lang i18n.LanguageCode)) {
@@ -128,3 +142,17 @@ func (l *Localizer) StatusLabel(status string) string {
 	}
 	return status
 }
+
+// flattenArgs turns a placeholder map into the flat name/value slice the bundle
+// takes. Iteration order is irrelevant: each pair substitutes an independent
+// {name}.
+func flattenArgs(args map[string]string) []string {
+	if len(args) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(args)*2)
+	for name, value := range args {
+		out = append(out, name, value)
+	}
+	return out
+}

client/ui/main.go

@@ -8,13 +8,13 @@ import (
 	"flag"
 	"io/fs"
 	"log"
-	"os"
 	"runtime"
 	"strings"
 
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -63,7 +63,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *Notifier
+	notifier        *notifications.NotificationService
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -80,14 +80,6 @@ func init() {
 }
 
 func main() {
-	// The one-shot that applies the settings the daemon restricts to
-	// root/administrator, which this binary runs itself as under the platform's
-	// elevation prompt. Handled before anything GUI so no window, tray or
-	// single-instance lock is involved.
-	if services.IsPrivilegedSettingsRun(os.Args[1:]) {
-		os.Exit(runPrivilegedSettings(os.Args[1:]))
-	}
-
 	daemonAddr, userSetLogFile := parseFlagsAndInitLog()
 	conn := NewConn(daemonAddr)
 
@@ -110,7 +102,7 @@ func main() {
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := newNotifier()
+	notifier := notifications.New()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -218,7 +210,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *Notifier) {
+func requestNotificationAuthorization(notifier *notifications.NotificationService) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)

client/ui/notifier.go

@@ -1,101 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"
-)
-
-var errNotificationsUnavailable = errors.New("notifications unavailable")
-
-// Notifier wraps the Wails notification service so an unavailable backend
-// disables notifications instead of aborting the app. Startup fails for
-// environment reasons (a bare unbundled binary on macOS has no bundle
-// identifier, a headless Linux session has no D-Bus session bus), and Wails
-// treats a service startup error as fatal. After a failed startup every call
-// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
-// identifier raises an Objective-C exception that recover() cannot catch.
-type Notifier struct {
-	inner     *notifications.NotificationService
-	available atomic.Bool
-}
-
-func newNotifier() *Notifier {
-	return &Notifier{inner: notifications.New()}
-}
-
-// ServiceName implements the Wails service-name hook for startup logs.
-func (n *Notifier) ServiceName() string {
-	return n.inner.ServiceName()
-}
-
-// ServiceStartup starts the platform notifier, downgrading failure to a
-// warning so the app keeps running without notifications.
-func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
-	if err := n.inner.ServiceStartup(ctx, options); err != nil {
-		log.Warnf("notifications disabled: %v", err)
-		return nil
-	}
-	n.available.Store(true)
-	return nil
-}
-
-func (n *Notifier) ServiceShutdown() error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.ServiceShutdown()
-}
-
-func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.CheckNotificationAuthorization()
-}
-
-func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.RequestNotificationAuthorization()
-}
-
-// SendNotification delivers a notification, silently dropping it when the
-// backend never started (notifications are best-effort everywhere).
-func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotification(options)
-}
-
-func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotificationWithActions(options)
-}
-
-func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.RegisterNotificationCategory(category)
-}
-
-// OnNotificationResponse registers the response callback. Pure Go state, so
-// it is safe (and simply inert) when the backend never started.
-//
-//wails:ignore
-func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
-	n.inner.OnNotificationResponse(callback)
-}

client/ui/preferences/store.go

@@ -246,7 +246,6 @@ func (s *Store) ExistedAtLoad() bool {
 func (s *Store) load() error {
 	if _, err := os.Stat(s.path); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			log.Infof("no ui preferences file at %s; using defaults", s.path)
 			return nil
 		}
 		return fmt.Errorf("stat preferences: %w", err)

client/ui/privileged_settings.go

@@ -1,27 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// The one-shot mode this binary runs itself in, elevated, to apply the settings the
-// daemon restricts to root/administrator. It is handled before anything GUI, so no
-// window, tray or single-instance lock is involved.
-//
-// Only the wiring is here: what the mode accepts and does lives beside the code
-// that asks for it, in services.RunPrivilegedSettings, so the settings it will
-// apply are declared once. There is nothing privileged about the mode itself; it
-// sends the same request the frontend would have sent, and the daemon authorizes it
-// from the identity the kernel reports on the control channel exactly as it does
-// for `sudo netbird up`.
-func runPrivilegedSettings(args []string) int {
-	return services.RunPrivilegedSettings(args, func(addr string) (proto.DaemonServiceClient, error) {
-		if addr == "" {
-			addr = DaemonAddr()
-		}
-		return NewConn(addr).Client()
-	})
-}

client/ui/services/connection.go

@@ -33,21 +33,12 @@ type LoginResult struct {
 	UserCode                string `json:"userCode"`
 	VerificationURI         string `json:"verificationUri"`
 	VerificationURIComplete string `json:"verificationUriComplete"`
-	// ProfileID is the ID of the profile this login ran against, or "" when the
-	// caller named the profile itself and no ID was resolved. Pass it back in
-	// WaitSSOParams so the account email lands on this profile even if the
-	// active one changes during SSO.
-	ProfileID string `json:"profileId"`
 }
 
 // WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
-	// ProfileID is the profile the login was started for, used to file the
-	// account email against it rather than against whichever profile is active
-	// when the flow returns. Optional: empty falls back to the active profile.
-	ProfileID string `json:"profileId"`
 }
 
 // UpParams selects the profile to bring up.
@@ -86,16 +77,11 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	// Fall back to the daemon's active profile and the current OS user.
 	profileName := p.ProfileName
 	username := p.Username
-	// Only set when the daemon told us the ID. A caller-supplied ProfileName is
-	// a handle — a display name or an ID prefix resolve too — and the state file
-	// is named after the ID, so passing a handle on would name the wrong file.
-	profileID := ""
 	if profileName == "" {
 		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
 			// Address the active profile by ID (the daemon resolves it as a
 			// handle); names can collide, the ID cannot.
 			profileName = active.GetId()
-			profileID = profileName
 			if username == "" {
 				username = active.GetUsername()
 			}
@@ -136,7 +122,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 		UserCode:                resp.GetUserCode(),
 		VerificationURI:         resp.GetVerificationURI(),
 		VerificationURIComplete: resp.GetVerificationURIComplete(),
-		ProfileID:               profileID,
 	}, nil
 }
 
@@ -257,31 +242,6 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 		return "", s.classifyDaemonError(err)
 	}
 	log.Infof("SSO login completed, daemon reported success")
-
-	// Persist the account email the same way the CLI does after its own
-	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
-	// root and the per-profile state file is user-owned (see Logout below).
-	// Without this the profile has no email, so Profiles.List shows no account
-	// and later logins and session extends go out without a login_hint —
-	// leaving the IdP to guess which account was meant.
-	if email := resp.GetEmail(); email != "" {
-		state := &profilemanager.ProfileState{Email: email}
-		pm := profilemanager.NewProfileManager()
-
-		// Against the profile the login was started for: SSO spans seconds of
-		// user interaction, and a profile switch in that window would otherwise
-		// file the email under the wrong profile.
-		if p.ProfileID != "" {
-			err = pm.SetProfileState(profilemanager.ID(p.ProfileID), state)
-		} else {
-			err = pm.SetActiveProfileState(state)
-		}
-		if err != nil {
-			// Non-fatal: the login itself succeeded.
-			log.Warnf("failed to store account email: %v", err)
-		}
-	}
-
 	return resp.GetEmail(), nil
 }
 

client/ui/services/daemon_feed.go

@@ -59,13 +59,21 @@ type Emitter interface {
 
 // SystemEvent is the frontend-facing shape of a daemon SystemEvent.
 type SystemEvent struct {
-	ID          string            `json:"id"`
-	Severity    string            `json:"severity"`
-	Category    string            `json:"category"`
-	Message     string            `json:"message"`
-	UserMessage string            `json:"userMessage"`
-	Timestamp   int64             `json:"timestamp"`
-	Metadata    map[string]string `json:"metadata"`
+	ID          string `json:"id"`
+	Severity    string `json:"severity"`
+	Category    string `json:"category"`
+	Message     string `json:"message"`
+	UserMessage string `json:"userMessage"`
+	// MessageKey names the localizable body for this event; empty on control
+	// events and on events from a daemon that predates the field. Resolve it
+	// against the UI bundle and fall back to UserMessage on a miss.
+	MessageKey  string            `json:"messageKey"`
+	MessageArgs map[string]string `json:"messageArgs"`
+	// TitleKey names the localizable notification title, empty when the event
+	// has none and the consumer should compose one from severity and category.
+	TitleKey  string            `json:"titleKey"`
+	Timestamp int64             `json:"timestamp"`
+	Metadata  map[string]string `json:"metadata"`
 }
 
 // PeerStatus is the frontend-facing shape of a daemon PeerState.
@@ -563,6 +571,9 @@ func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
 		Category:    strings.ToLower(strings.TrimPrefix(e.GetCategory().String(), "SystemEvent_")),
 		Message:     e.GetMessage(),
 		UserMessage: e.GetUserMessage(),
+		MessageKey:  e.GetMessageKey(),
+		MessageArgs: e.GetMessageArgs(),
+		TitleKey:    e.GetTitleKey(),
 		Metadata:    map[string]string{},
 	}
 	if ts := e.GetTimestamp(); ts != nil {

client/ui/services/guarded.go

@@ -1,231 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/elevate"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-)
-
-// The command line of the one-shot mode this binary runs itself in, elevated, to
-// apply a setting the daemon restricts to root/administrator. The setting flags
-// spell the same words as `netbird up`, so the command a user is shown and what
-// runs behind the prompt read alike. Parsed in oneshot.go.
-const (
-	FlagApplyPrivilegedSettings = "apply-privileged-settings"
-	FlagDaemonAddr              = "daemon-addr"
-	FlagProfile                 = "profile"
-	FlagUser                    = "user"
-	FlagLogLevel                = "log-level"
-	FlagManagementURL           = "management-url"
-	FlagAllowServerSSH          = "allow-server-ssh"
-	FlagEnableSSHRoot           = "enable-ssh-root"
-	FlagDisableSSHAuth          = "disable-ssh-auth"
-)
-
-// Error codes for the ways asking for privileges can fail.
-const (
-	CodeElevationUnavailable = "elevation_unavailable"
-	CodeElevationFailed      = "elevation_failed"
-)
-
-// elevationTimeout bounds the wait for a prompt and the change behind it, so a
-// dialog nobody answers does not leave its control disabled for the session. Long
-// enough to find a password manager, and no shorter than the platforms' own prompt
-// timeouts: Windows gives up on its consent dialog after two minutes by itself.
-//
-// It always ends our waiting, and not always the prompt: Security.framework offers
-// no way to withdraw a request, so on macOS the system's own timeout is what closes
-// the dialog.
-const elevationTimeout = 5 * time.Minute
-
-// elevator raises the platform's privilege prompt and runs the change behind it.
-// An interface so tests can answer without a prompt.
-type elevator interface {
-	// Run runs this binary again, elevated, with the given arguments.
-	Run(ctx context.Context, args ...string) error
-	// Available reports whether there is a prompt to raise on this host at all.
-	Available() bool
-}
-
-// osElevator is the real thing: see the elevate package.
-type osElevator struct{}
-
-func (osElevator) Run(ctx context.Context, args ...string) error {
-	return elevate.Run(ctx, args...)
-}
-
-func (osElevator) Available() bool {
-	return elevate.Available()
-}
-
-// SaveOutcome reports what became of a change that needed authorization.
-//
-// A declined prompt is a result, not an error: the user was asked and said no, so
-// nothing was applied and nothing went wrong. Reporting it as an error would have
-// every cancelled prompt logged as one.
-type SaveOutcome struct {
-	// Declined is set when the user dismissed the authorization prompt, or was
-	// refused by policy. Nothing was changed.
-	Declined bool `json:"declined"`
-}
-
-// GuardedSettings is the subset of the config the daemon restricts to
-// root/administrator. Only the fields that are set are changed: a nil pointer, or
-// an empty management URL, leaves that setting alone.
-//
-// The management URL is in here because pointing a host with the SSH server
-// running at another management identity hands the decision of who may open a
-// shell on it to whoever runs that server, which is the same power as enabling
-// the SSH server in the first place.
-type GuardedSettings struct {
-	ProfileName      string `json:"profileName"`
-	Username         string `json:"username"`
-	ManagementURL    string `json:"managementUrl,omitempty"`
-	ServerSSHAllowed *bool  `json:"serverSshAllowed,omitempty"`
-	EnableSSHRoot    *bool  `json:"enableSshRoot,omitempty"`
-	DisableSSHAuth   *bool  `json:"disableSshAuth,omitempty"`
-}
-
-// guardedSetting is one setting to change, in the two spellings this needs: the
-// one-shot's own flag, and the `netbird up` flag that does the same thing from a
-// terminal, for when there is no prompt to raise.
-type guardedSetting struct {
-	arg  string
-	flag string
-}
-
-// SetGuardedSettings applies settings the daemon refuses from an unprivileged
-// caller, by having the operating system run this binary again, elevated, to send
-// the same request the frontend would have sent itself.
-//
-// The user authorizes it at the platform's own prompt: the UAC consent dialog,
-// the macOS authentication dialog, or the polkit agent's. Any credentials are the
-// operating system's business; NetBird neither sees nor asks for them. Nothing
-// about the daemon's rules changes, and the elevated process is authorized like
-// any other privileged caller, from the identity the kernel reports for it.
-//
-// A declined prompt comes back as SaveOutcome.Declined with no error. When there is
-// no prompt to raise, or the elevated run failed, the error carries the command
-// that does the same thing from a terminal.
-func (s *Settings) SetGuardedSettings(ctx context.Context, p GuardedSettings) (SaveOutcome, error) {
-	settings := guardedSettings(p)
-	if len(settings) == 0 {
-		return SaveOutcome{}, &ClientError{
-			Code:  CodeElevationFailed,
-			Short: "no setting to apply",
-			Long:  "no setting to apply",
-		}
-	}
-
-	// The elevated run has no window and, on Linux, an environment pkexec has
-	// cleared, so what it writes to stderr is all there is to go on. It follows
-	// this process's level so that starting the app with --log-level debug says
-	// something about the run behind the prompt too.
-	args := append([]string{
-		"--" + FlagApplyPrivilegedSettings,
-		"--" + FlagDaemonAddr, s.daemonAddr,
-		"--" + FlagProfile, p.ProfileName,
-		"--" + FlagUser, p.Username,
-		"--" + FlagLogLevel, log.GetLevel().String(),
-	}, oneShotArgs(settings)...)
-
-	ctx, cancel := context.WithTimeout(ctx, elevationTimeout)
-	defer cancel()
-
-	// These changes hand out shells on this host, so both ends are logged: when the
-	// prompt went up, and what came of it. It is also the only account of a prompt
-	// that was slow to appear or never answered.
-	log.Infof("asking for privileges to apply %s", guardedSummary(p))
-
-	if err := s.elevator.Run(ctx, args...); err != nil {
-		return s.elevationOutcome(err, p)
-	}
-
-	log.Infof("applied %s with the privileges the user authorized", guardedSummary(p))
-	return SaveOutcome{}, nil
-}
-
-// elevationOutcome sorts what came back into the one normal ending and the two
-// that need reporting, with the command that does the same thing by hand.
-func (s *Settings) elevationOutcome(err error, p GuardedSettings) (SaveOutcome, error) {
-	switch {
-	case errors.Is(err, elevate.ErrDeclined):
-		// With the reason: an account that may not elevate at all lands here too,
-		// and the log is the only place that says which it was.
-		log.Infof("the elevation prompt for %s was declined: %v", guardedSummary(p), err)
-		return SaveOutcome{Declined: true}, nil
-	case errors.Is(err, elevate.ErrUnavailable):
-		log.Warnf("cannot ask for privileges to apply %s: %v", guardedSummary(p), err)
-		return SaveOutcome{}, &ClientError{
-			Code:    CodeElevationUnavailable,
-			Short:   s.classifier.translateShort(CodeElevationUnavailable),
-			Long:    err.Error(),
-			Command: guardedCommand(p),
-		}
-	default:
-		log.Errorf("applying %s with elevated privileges failed: %v", guardedSummary(p), err)
-		return SaveOutcome{}, &ClientError{
-			Code:    CodeElevationFailed,
-			Short:   s.classifier.translateShort(CodeElevationFailed),
-			Long:    err.Error(),
-			Command: guardedCommand(p),
-		}
-	}
-}
-
-// guardedSettings renders the settings that are actually being changed, from the
-// same table the one-shot parses them with: see oneshot.go.
-func guardedSettings(p GuardedSettings) []guardedSetting {
-	var settings []guardedSetting
-	for _, field := range guardedFields {
-		value, ok := field.read(p)
-		if !ok {
-			continue
-		}
-		settings = append(settings, guardedSetting{
-			arg:  "--" + field.flag + "=" + value,
-			flag: field.up(value),
-		})
-	}
-	return settings
-}
-
-func oneShotArgs(settings []guardedSetting) []string {
-	args := make([]string, 0, len(settings))
-	for _, setting := range settings {
-		args = append(args, setting.arg)
-	}
-	return args
-}
-
-func upFlags(settings []guardedSetting) []string {
-	flags := make([]string, 0, len(settings))
-	for _, setting := range settings {
-		flags = append(flags, setting.flag)
-	}
-	return flags
-}
-
-// guardedCommand is the elevated command line equivalent to the requested
-// change, the same shape the daemon names in its own refusals.
-func guardedCommand(p GuardedSettings) string {
-	settings := guardedSettings(p)
-	if len(settings) == 0 {
-		return ""
-	}
-	return ipcauth.UpCommand(strings.Join(upFlags(settings), " "))
-}
-
-// guardedSummary names the change for the log.
-func guardedSummary(p GuardedSettings) string {
-	return fmt.Sprintf("%v for profile %q", oneShotArgs(guardedSettings(p)), p.ProfileName)
-}

client/ui/services/guarded_test.go

@@ -1,355 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/genproto/googleapis/rpc/errdetails"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal/elevate"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A Unix socket, so the daemon address is one that carries a caller's identity and
-// elevation is worth offering at all: see Settings.canElevate.
-const testDaemonAddr = "unix:///var/run/netbird.sock"
-
-// storedManagementURL is what the stub daemon already holds, so that a request
-// naming a different one is a change: see Settings.guardedChanges.
-const storedManagementURL = "https://stored.example.com"
-
-// stubElevator stands in for the platform's prompt: it records what would have run
-// and answers with a fixed outcome.
-type stubElevator struct {
-	outcome   error
-	available bool
-	calls     [][]string
-}
-
-func (e *stubElevator) Run(_ context.Context, args ...string) error {
-	e.calls = append(e.calls, args)
-	return e.outcome
-}
-
-func (e *stubElevator) Available() bool { return e.available }
-
-// stubDaemon implements only the RPCs under test. The embedded interface is nil, so
-// any other call panics rather than passing quietly.
-type stubDaemon struct {
-	proto.DaemonServiceClient
-	setConfig func(*proto.SetConfigRequest) error
-	// stored is what GetConfig reports, which is what a refused request's guarded
-	// settings are compared against.
-	stored   *proto.GetConfigResponse
-	requests []*proto.SetConfigRequest
-}
-
-func (d *stubDaemon) SetConfig(_ context.Context, in *proto.SetConfigRequest, _ ...grpc.CallOption) (*proto.SetConfigResponse, error) {
-	d.requests = append(d.requests, in)
-	if err := d.setConfig(in); err != nil {
-		return nil, err
-	}
-	return &proto.SetConfigResponse{}, nil
-}
-
-func (d *stubDaemon) GetConfig(_ context.Context, _ *proto.GetConfigRequest, _ ...grpc.CallOption) (*proto.GetConfigResponse, error) {
-	return d.stored, nil
-}
-
-type stubConn struct{ client proto.DaemonServiceClient }
-
-func (c stubConn) Client() (proto.DaemonServiceClient, error) { return c.client, nil }
-
-// privilegeRefusal is the error the daemon raises for a change it restricts to
-// root, detail and all: see server.privilegeError.
-func privilegeRefusal(t *testing.T) error {
-	t.Helper()
-
-	st, err := gstatus.New(codes.PermissionDenied, "Changing the management URL requires root.").
-		WithDetails(&errdetails.ErrorInfo{
-			Reason: ipcauth.ErrorReasonPrivilegeRequired,
-			Domain: ipcauth.ErrorDomain,
-			Metadata: map[string]string{
-				ipcauth.ErrorMetaSummary: "Changing the management URL requires root.",
-				ipcauth.ErrorMetaCommand: "sudo netbird down; sudo netbird up -m https://mgmt.example.com",
-			},
-		})
-	require.NoError(t, err, "build the refusal detail")
-	return st.Err()
-}
-
-func settingsWithElevation(t *testing.T, outcome error) (*Settings, *stubElevator) {
-	t.Helper()
-
-	elev := &stubElevator{outcome: outcome, available: true}
-	return &Settings{daemonAddr: testDaemonAddr, elevator: elev}, elev
-}
-
-// settingsRefusingOnce returns a Settings whose daemon refuses the first SetConfig
-// for want of privileges and accepts anything after it. Its stored config holds
-// another management server and no SSH grants, so a request naming either is a
-// change rather than a restatement.
-func settingsRefusingOnce(t *testing.T, elev *stubElevator) (*Settings, *stubDaemon) {
-	t.Helper()
-
-	refusal := privilegeRefusal(t)
-	daemon := &stubDaemon{stored: &proto.GetConfigResponse{ManagementUrl: storedManagementURL}}
-	daemon.setConfig = func(*proto.SetConfigRequest) error {
-		if len(daemon.requests) == 1 {
-			return refusal
-		}
-		return nil
-	}
-	return &Settings{conn: stubConn{client: daemon}, daemonAddr: testDaemonAddr, elevator: elev}, daemon
-}
-
-func TestSetGuardedSettingsPassesOnlyTheChangedSettings(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	root := true
-	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:   "work",
-		Username:      "vma",
-		EnableSSHRoot: &root,
-	})
-	require.NoError(t, err)
-	assert.False(t, outcome.Declined, "the prompt was answered")
-
-	want := []string{
-		"--" + FlagApplyPrivilegedSettings,
-		"--" + FlagDaemonAddr, testDaemonAddr,
-		"--" + FlagProfile, "work",
-		"--" + FlagUser, "vma",
-		"--" + FlagLogLevel, log.GetLevel().String(),
-		"--" + FlagEnableSSHRoot + "=true",
-	}
-	require.Len(t, elev.calls, 1, "one prompt for one change")
-	assert.Equal(t, want, elev.calls[0], "elevated arguments")
-
-	// argv[1] is what the polkit action is pinned to, so the marker has to stay
-	// first however the rest of the line grows.
-	assert.Equal(t, "--"+FlagApplyPrivilegedSettings, elev.calls[0][0], "the flag polkit matches on")
-}
-
-// Turning a setting off has to be as explicit as turning it on: a bare flag would
-// read as "on" to the one-shot's parser.
-func TestSetGuardedSettingsSpellsOutFalse(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	off := false
-	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:      "default",
-		ServerSSHAllowed: &off,
-		DisableSSHAuth:   &off,
-	})
-	require.NoError(t, err)
-
-	args := elev.calls[0]
-	assert.Contains(t, args, "--"+FlagAllowServerSSH+"=false", "the setting being switched off")
-	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=false", "the setting being switched off")
-	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "no flag for a setting nobody touched")
-}
-
-func TestSetGuardedSettingsPassesTheManagementURL(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com:33073",
-	})
-	require.NoError(t, err)
-
-	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com:33073",
-		"the management URL to point the profile at")
-}
-
-func TestSetGuardedSettingsWithoutASettingDoesNotElevate(t *testing.T) {
-	s, elev := settingsWithElevation(t, nil)
-
-	_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{ProfileName: "default"})
-
-	require.Error(t, err, "nothing to apply is not something to prompt for")
-	assert.Empty(t, elev.calls, "no prompt at all")
-}
-
-// A declined prompt is the one ending that is not an error: reporting it as one
-// would have every cancelled prompt logged as a failure.
-func TestSetGuardedSettingsReportsADeclinedPromptAsAnOutcome(t *testing.T) {
-	s, _ := settingsWithElevation(t, elevate.ErrDeclined)
-
-	root := true
-	outcome, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-		ProfileName:   "default",
-		EnableSSHRoot: &root,
-	})
-
-	require.NoError(t, err, "the user was asked and answered; nothing went wrong")
-	assert.True(t, outcome.Declined, "nothing was applied")
-}
-
-func TestSetGuardedSettingsMapsFailures(t *testing.T) {
-	tests := []struct {
-		name     string
-		outcome  error
-		wantCode string
-	}{
-		{
-			// Nothing to raise a prompt with: the user needs the command.
-			name:     "no mechanism falls back to the command",
-			outcome:  elevate.ErrUnavailable,
-			wantCode: CodeElevationUnavailable,
-		},
-		{
-			name:     "a failed run falls back to the command",
-			outcome:  errors.New("elevated netbird exited with 1"),
-			wantCode: CodeElevationFailed,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			s, _ := settingsWithElevation(t, tt.outcome)
-
-			root := true
-			_, err := s.SetGuardedSettings(context.Background(), GuardedSettings{
-				ProfileName:   "default",
-				EnableSSHRoot: &root,
-			})
-
-			var clientErr *ClientError
-			require.ErrorAs(t, err, &clientErr, "the frontend needs a code to act on")
-			assert.Equal(t, tt.wantCode, clientErr.Code, "error code")
-			assert.Contains(t, clientErr.Command, "--"+FlagEnableSSHRoot+"=true",
-				"the setting in the fallback command")
-			assert.Contains(t, clientErr.Command, "netbird up", "the fallback command")
-		})
-	}
-}
-
-// Changing the management URL is only privileged while the host runs the SSH
-// server, which no control can know up front, so the refusal is what triggers the
-// prompt. The original request goes again afterwards, so the fields the one-shot
-// does not understand are applied too.
-func TestSetConfigElevatesAfterARefusalAndRetries(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, daemon := settingsRefusingOnce(t, elev)
-
-	mtu := int64(1280)
-	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com",
-		MTU:           &mtu,
-	})
-	require.NoError(t, err)
-	assert.False(t, outcome.Declined, "the prompt was answered")
-
-	require.Len(t, elev.calls, 1, "one prompt")
-	assert.Contains(t, elev.calls[0], "--"+FlagManagementURL+"=https://mgmt.example.com",
-		"the guarded part of the request")
-	require.Len(t, daemon.requests, 2, "the refused request and the retry")
-	assert.Equal(t, mtu, daemon.requests[1].GetMtu(),
-		"the retry carries the rest of the request, which the one-shot does not understand")
-}
-
-func TestSetConfigDoesNotRetryWhenTheUserDeclines(t *testing.T) {
-	elev := &stubElevator{outcome: elevate.ErrDeclined, available: true}
-	s, daemon := settingsRefusingOnce(t, elev)
-
-	outcome, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com",
-	})
-
-	require.NoError(t, err, "a declined prompt is not an error")
-	assert.True(t, outcome.Declined, "nothing was applied")
-	assert.Len(t, daemon.requests, 1, "only the refused request")
-}
-
-// With no prompt to raise, the refusal is reported as the daemon wrote it, which is
-// the guidance that was there before elevation existed.
-func TestSetConfigReportsTheRefusalWhenItCannotElevate(t *testing.T) {
-	elev := &stubElevator{available: false}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	_, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:   "default",
-		ManagementURL: "https://mgmt.example.com",
-	})
-
-	var clientErr *ClientError
-	require.ErrorAs(t, err, &clientErr)
-	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
-	assert.Contains(t, clientErr.Command, "netbird up -m https://mgmt.example.com",
-		"the daemon's own command")
-	assert.Empty(t, elev.calls, "no prompt where there is none to raise")
-}
-
-// One authorization must buy only the change the user made. A settings form
-// submits every field it holds, so most of a refused request restates what the
-// daemon already has, and elevating those too would apply a guarded setting the
-// user never touched — a value gone stale since the form loaded above all.
-func TestSetConfigElevatesOnlyTheGuardedSettingsThatChange(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	on, off := true, false
-	_, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:      "default",
-		ManagementURL:    storedManagementURL,
-		ServerSSHAllowed: &off,
-		EnableSSHRoot:    &off,
-		DisableSSHAuth:   &on,
-	})
-	require.NoError(t, err)
-
-	require.Len(t, elev.calls, 1, "one prompt")
-	args := elev.calls[0]
-	assert.Contains(t, args, "--"+FlagDisableSSHAuth+"=true", "the setting that changes")
-	assert.NotContains(t, args, "--"+FlagManagementURL+"="+storedManagementURL,
-		"a management URL the daemon already holds")
-	assert.NotContains(t, args, "--"+FlagAllowServerSSH+"=false", "a setting already off")
-	assert.NotContains(t, args, "--"+FlagEnableSSHRoot+"=false", "a setting already off")
-}
-
-// A request that changes no guarded setting has nothing an elevated run could
-// apply, so the refusal must have come from somewhere a prompt cannot reach.
-func TestSetConfigDoesNotElevateWhenNoGuardedSettingChanges(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	off := false
-	_, err := s.SetConfig(context.Background(), SetConfigParams{
-		ProfileName:      "default",
-		ManagementURL:    storedManagementURL,
-		ServerSSHAllowed: &off,
-	})
-
-	var clientErr *ClientError
-	require.ErrorAs(t, err, &clientErr)
-	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
-	assert.Empty(t, elev.calls, "no prompt for a change nobody made")
-}
-
-// A refusal with nothing in the request the one-shot could apply: the daemon
-// cannot see who is calling, and being root would not help either.
-func TestSetConfigReportsARefusalWithNothingToElevate(t *testing.T) {
-	elev := &stubElevator{available: true}
-	s, _ := settingsRefusingOnce(t, elev)
-
-	_, err := s.SetConfig(context.Background(), SetConfigParams{ProfileName: "default"})
-
-	var clientErr *ClientError
-	require.ErrorAs(t, err, &clientErr)
-	assert.Equal(t, "privilege_required", clientErr.Code, "error code")
-	assert.Empty(t, elev.calls, "no prompt")
-}

client/ui/services/oneshot.go

@@ -1,239 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal/elevate"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/util"
-)
-
-// The other end of SetGuardedSettings: the mode this binary runs itself in,
-// elevated, to apply the settings the daemon restricts to root/administrator.
-//
-// Both ends are here on purpose. What may be changed this way is an allowlist, and
-// an allowlist declared twice is one that will eventually disagree with itself, so
-// the arguments are rendered and parsed from a single table: guardedFields. Adding
-// a setting is one row; nothing generic passes through, and no field outside the
-// table can be reached with an elevated request no matter what lands on the command
-// line.
-
-// oneShotTimeout bounds the whole one-shot: connect, one RPC, exit. Generous
-// because the user has just waited for an authentication dialog, and a failure here
-// costs them the entire round trip.
-const oneShotTimeout = 30 * time.Second
-
-// Exit codes the parent reads where the platform gives it one.
-const (
-	exitOK      = 0
-	exitFailure = 1
-	exitUsage   = 2
-)
-
-// guardedField is one setting the one-shot understands, in the two spellings it
-// needs and with the two halves of its plumbing.
-type guardedField struct {
-	// flag names it on the one-shot's command line.
-	flag  string
-	usage string
-	// read returns the value to send and whether the caller asked for this setting
-	// at all.
-	read func(GuardedSettings) (string, bool)
-	// write parses a value from the command line onto the request. It is the only
-	// thing that validates the value, so it fails on anything it does not
-	// recognise rather than guessing.
-	write func(*proto.SetConfigRequest, string) error
-	// up renders the equivalent `netbird up` flag, for the fallback command shown
-	// when there is no prompt to raise.
-	up func(value string) string
-}
-
-var guardedFields = []guardedField{
-	{
-		flag:  FlagManagementURL,
-		usage: "Management server the profile registers with.",
-		read:  func(p GuardedSettings) (string, bool) { return p.ManagementURL, p.ManagementURL != "" },
-		write: func(req *proto.SetConfigRequest, value string) error {
-			// Parsed with the config layer's own parser, so what the elevated run
-			// accepts cannot drift from what the daemon would store.
-			if _, err := profilemanager.ParseServiceURL("Management URL", value); err != nil {
-				return err
-			}
-			req.ManagementUrl = value
-			return nil
-		},
-		// The daemon names this one as `-m <url>` in its own refusals.
-		up: func(value string) string { return "-m " + value },
-	},
-	boolField(FlagAllowServerSSH, "Run the NetBird SSH server.",
-		func(p GuardedSettings) *bool { return p.ServerSSHAllowed },
-		func(req *proto.SetConfigRequest, v *bool) { req.ServerSSHAllowed = v }),
-	boolField(FlagEnableSSHRoot, "Allow SSH sessions to privileged accounts.",
-		func(p GuardedSettings) *bool { return p.EnableSSHRoot },
-		func(req *proto.SetConfigRequest, v *bool) { req.EnableSSHRoot = v }),
-	boolField(FlagDisableSSHAuth, "Accept SSH sessions without authentication.",
-		func(p GuardedSettings) *bool { return p.DisableSSHAuth },
-		func(req *proto.SetConfigRequest, v *bool) { req.DisableSSHAuth = v }),
-}
-
-// fieldValue is a flag that remembers whether it was given, and requires a value:
-// the renderer always writes one, so a bare flag is a caller that got it wrong.
-type fieldValue struct {
-	set   bool
-	value string
-}
-
-func (v *fieldValue) String() string {
-	if v == nil {
-		return ""
-	}
-	return v.value
-}
-
-func (v *fieldValue) Set(value string) error {
-	v.set, v.value = true, value
-	return nil
-}
-
-// boolField describes a setting that is on or off. The value is always spelled out,
-// so that turning a setting off is as unambiguous as turning it on and a flag with
-// no value is a mistake rather than an "on".
-func boolField(
-	name, usage string,
-	read func(GuardedSettings) *bool,
-	write func(*proto.SetConfigRequest, *bool),
-) guardedField {
-	return guardedField{
-		flag:  name,
-		usage: usage,
-		read: func(p GuardedSettings) (string, bool) {
-			value := read(p)
-			if value == nil {
-				return "", false
-			}
-			return strconv.FormatBool(*value), true
-		},
-		write: func(req *proto.SetConfigRequest, value string) error {
-			parsed, err := strconv.ParseBool(value)
-			if err != nil {
-				return fmt.Errorf("parse %q as a boolean: %w", value, err)
-			}
-			write(req, &parsed)
-			return nil
-		},
-		up: func(value string) string { return "--" + name + "=" + value },
-	}
-}
-
-// IsPrivilegedSettingsRun reports whether this process was started as the one-shot.
-// The flag is a marker rather than a value, so only the bare forms count: reading a
-// value would mean "--flag=false" started it too.
-func IsPrivilegedSettingsRun(args []string) bool {
-	for _, arg := range args {
-		if arg == "--"+FlagApplyPrivilegedSettings || arg == "-"+FlagApplyPrivilegedSettings {
-			return true
-		}
-	}
-	return false
-}
-
-// RunPrivilegedSettings applies the requested settings and returns the process exit
-// code. connect dials the daemon, which is the caller's business because only it
-// knows how this build talks to it.
-//
-// Everything it reports goes to stderr, which is what the parent captures where the
-// platform lets it. On success it says so on standard output, because macOS gives
-// the parent no exit status to read: see elevate.AppliedMarker.
-func RunPrivilegedSettings(args []string, connect func(addr string) (proto.DaemonServiceClient, error)) int {
-	fs := flag.NewFlagSet("netbird-ui --"+FlagApplyPrivilegedSettings, flag.ContinueOnError)
-	fs.Bool(FlagApplyPrivilegedSettings, false, "Apply the settings the daemon restricts to root/administrator and exit.")
-	daemonAddr := fs.String(FlagDaemonAddr, "", "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port")
-	logLevel := fs.String(FlagLogLevel, "info", "Log level: trace|debug|info|warn|error.")
-	profile := fs.String(FlagProfile, "", "Profile to change.")
-	username := fs.String(FlagUser, "", "Owner of the profile.")
-
-	values := make([]fieldValue, len(guardedFields))
-	for i, field := range guardedFields {
-		fs.Var(&values[i], field.flag, field.usage)
-	}
-
-	if err := fs.Parse(args); err != nil {
-		return exitUsage
-	}
-
-	if err := util.InitLog(*logLevel, "console"); err != nil {
-		fmt.Fprintf(os.Stderr, "init log: %v\n", err)
-		return exitFailure
-	}
-
-	req, err := privilegedRequest(*profile, *username, values)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%v\n", err)
-		return exitUsage
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), oneShotTimeout)
-	defer cancel()
-
-	if err := applyPrivilegedSettings(ctx, *daemonAddr, req, connect); err != nil {
-		fmt.Fprintf(os.Stderr, "apply settings: %v\n", err)
-		return exitFailure
-	}
-
-	fmt.Fprintln(os.Stdout, elevate.AppliedMarker)
-	return exitOK
-}
-
-// privilegedRequest builds the request from the flags that were given, and refuses
-// one that asks for nothing.
-func privilegedRequest(profile, username string, values []fieldValue) (*proto.SetConfigRequest, error) {
-	req := &proto.SetConfigRequest{ProfileName: profile, Username: username}
-
-	given := 0
-	for i, field := range guardedFields {
-		if !values[i].set {
-			continue
-		}
-		if err := field.write(req, values[i].value); err != nil {
-			return nil, fmt.Errorf("--%s: %w", field.flag, err)
-		}
-		given++
-	}
-	if given == 0 {
-		return nil, errors.New("no setting to apply")
-	}
-	return req, nil
-}
-
-func applyPrivilegedSettings(
-	ctx context.Context,
-	daemonAddr string,
-	req *proto.SetConfigRequest,
-	connect func(addr string) (proto.DaemonServiceClient, error),
-) error {
-	client, err := connect(daemonAddr)
-	if err != nil {
-		return err
-	}
-	if _, err := client.SetConfig(ctx, req); err != nil {
-		// Unwrapped: the daemon's message is written for a person, and a refusal
-		// elevation cannot fix has to say so where the parent can read it off
-		// stderr.
-		return errors.New(gstatus.Convert(err).Message())
-	}
-	return nil
-}
-
-// interface guard: the one-shot's flags are flag.Value.
-var _ flag.Value = (*fieldValue)(nil)

client/ui/services/oneshot_test.go

@@ -1,151 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"flag"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func TestIsPrivilegedSettingsRun(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want bool
-	}{
-		{name: "no arguments"},
-		{name: "double dash", args: []string{"--" + FlagApplyPrivilegedSettings}, want: true},
-		{name: "single dash", args: []string{"-" + FlagApplyPrivilegedSettings}, want: true},
-		{
-			name: "among other flags",
-			args: []string{"--daemon-addr", "unix:///tmp/x.sock", "--" + FlagApplyPrivilegedSettings},
-			want: true,
-		},
-		// A marker, not a value: the caller never passes one, and reading a value
-		// would mean "--flag=false" started the one-shot too.
-		{name: "with a value", args: []string{"--" + FlagApplyPrivilegedSettings + "=true"}},
-		{name: "unrelated flags", args: []string{"--log-level", "debug"}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsPrivilegedSettingsRun(tt.args), "args %v", tt.args)
-		})
-	}
-}
-
-// What SetGuardedSettings renders has to be what the one-shot reads back, for every
-// setting in the table. This is the property that keeps the two ends of an allowlist
-// from drifting, so it is checked field by field rather than by example.
-func TestGuardedFieldsRoundTrip(t *testing.T) {
-	on, off := true, false
-	tests := []struct {
-		name     string
-		settings GuardedSettings
-		want     func(*testing.T, *proto.SetConfigRequest)
-	}{
-		{
-			name:     "management url",
-			settings: GuardedSettings{ManagementURL: "https://mgmt.example.com:33073"},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				assert.Equal(t, "https://mgmt.example.com:33073", req.GetManagementUrl())
-			},
-		},
-		{
-			name:     "ssh server on",
-			settings: GuardedSettings{ServerSSHAllowed: &on},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				require.NotNil(t, req.ServerSSHAllowed)
-				assert.True(t, *req.ServerSSHAllowed)
-			},
-		},
-		{
-			name:     "ssh root off",
-			settings: GuardedSettings{EnableSSHRoot: &off},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				require.NotNil(t, req.EnableSSHRoot, "an explicit false must survive, not read as absent")
-				assert.False(t, *req.EnableSSHRoot)
-			},
-		},
-		{
-			name:     "ssh auth off",
-			settings: GuardedSettings{DisableSSHAuth: &on},
-			want: func(t *testing.T, req *proto.SetConfigRequest) {
-				require.NotNil(t, req.DisableSSHAuth)
-				assert.True(t, *req.DisableSSHAuth)
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req := parseRendered(t, tt.settings)
-			tt.want(t, req)
-		})
-	}
-}
-
-// A setting nobody asked about must not arrive at the daemon at all: sending its
-// zero value would change it.
-func TestGuardedFieldsCarryOnlyWhatWasAsked(t *testing.T) {
-	on := true
-	req := parseRendered(t, GuardedSettings{ProfileName: "work", EnableSSHRoot: &on})
-
-	assert.Equal(t, "work", req.GetProfileName(), "profile")
-	require.NotNil(t, req.EnableSSHRoot)
-	assert.Nil(t, req.ServerSSHAllowed, "untouched setting")
-	assert.Nil(t, req.DisableSSHAuth, "untouched setting")
-	assert.Empty(t, req.GetManagementUrl(), "untouched setting")
-}
-
-func TestPrivilegedRequestRejectsAnEmptyChange(t *testing.T) {
-	_, err := privilegedRequest("default", "vma", make([]fieldValue, len(guardedFields)))
-	require.Error(t, err, "nothing to apply is not a request worth sending as root")
-}
-
-// A value the table cannot parse is refused rather than guessed at.
-func TestPrivilegedRequestRejectsAnUnparseableValue(t *testing.T) {
-	values := make([]fieldValue, len(guardedFields))
-	for i, field := range guardedFields {
-		if field.flag != FlagEnableSSHRoot {
-			continue
-		}
-		require.NoError(t, values[i].Set("perhaps"))
-	}
-
-	_, err := privilegedRequest("default", "vma", values)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), FlagEnableSSHRoot, "which flag was wrong")
-}
-
-// parseRendered puts the settings through both ends: rendered as the arguments the
-// elevated process is given, then parsed by a flag set registered from the same
-// table, which is what the one-shot itself parses them with. Anything hand-rolled
-// here would pin down a parser nothing uses.
-func parseRendered(t *testing.T, p GuardedSettings) *proto.SetConfigRequest {
-	t.Helper()
-
-	rendered := guardedSettings(p)
-	require.NotEmpty(t, rendered, "nothing rendered for %+v", p)
-
-	args := make([]string, 0, len(rendered))
-	for _, setting := range rendered {
-		args = append(args, setting.arg)
-	}
-
-	fs := flag.NewFlagSet(t.Name(), flag.ContinueOnError)
-	values := make([]fieldValue, len(guardedFields))
-	for i, field := range guardedFields {
-		fs.Var(&values[i], field.flag, field.usage)
-	}
-	require.NoError(t, fs.Parse(args), "the one-shot's own flag set must accept %v", args)
-
-	req, err := privilegedRequest(p.ProfileName, p.Username, values)
-	require.NoError(t, err)
-	return req
-}

client/ui/services/profile.go

@@ -6,8 +6,6 @@ import (
 	"context"
 	"os/user"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -153,31 +151,11 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	if err != nil {
 		return err
 	}
-	resp, err := cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+	_, err = cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
 		ProfileName: p.ProfileName,
 		Username:    p.Username,
 	})
-	if err != nil {
-		return err
-	}
-
-	// The daemon deletes what it owns but runs as root, so it leaves the
-	// user-owned state file holding the account email behind (same split as
-	// Connection.Logout). Legacy profiles are keyed by name rather than by a
-	// generated ID, so a recreated profile of the same name would inherit the
-	// deleted one's email and offer it as the login_hint.
-	//
-	// Keyed on the ID the daemon resolved, not on the request handle: that may
-	// have been a display name or an ID prefix, which would name a different
-	// file (or none).
-	if id := resp.GetId(); id != "" {
-		if err := profilemanager.NewProfileManager().RemoveProfileState(id); err != nil {
-			// Non-fatal: the profile itself is gone.
-			log.Warnf("failed to remove profile state for %s: %v", id, err)
-		}
-	}
-
-	return nil
+	return err
 }
 
 // Rename changes a profile's display name. The on-disk ID is unaffected, so

client/ui/services/settings.go

@@ -44,19 +44,12 @@ type Restrictions struct {
 }
 
 // Privilege tells the frontend whether this process may perform the changes the
-// daemon restricts to root/administrator, whether it can ask the operating
-// system for the privileges instead, and the command for each so a control that
-// can do neither can still show the way.
+// daemon restricts to root/administrator, and carries the command for each so a
+// disabled control can show the way to do it.
 type Privilege struct {
 	Privileged bool `json:"privileged"`
-	// ActorKey identifies the principal the operation requires without wording it,
-	// so the frontend can name it in the user's language: see
-	// ipcauth.PrivilegedActorKey. The words are not sent, because English ones
-	// cannot be dropped into a translated sentence.
-	ActorKey string `json:"actorKey"`
-	// CanElevate reports whether a guarded control can offer to authorize the
-	// change through the platform's own prompt: see SetGuardedSettings.
-	CanElevate bool `json:"canElevate"`
+	// Actor names what the operation requires ("root", "administrator privileges").
+	Actor string `json:"actor"`
 	// Commands equivalent to the settings the daemon guards, ready to copy.
 	AllowSSHServer string `json:"allowSshServer"`
 	EnableSSHRoot  string `json:"enableSshRoot"`
@@ -135,9 +128,6 @@ type Settings struct {
 	// daemonAddr is where the daemon listens, used to tell whether it runs as
 	// this user and would therefore authorize us: see Privilege.
 	daemonAddr string
-	// elevator raises the platform's privilege prompt when a change needs more
-	// rights than this process has.
-	elevator elevator
 }
 
 func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference, daemonAddr string) *Settings {
@@ -145,7 +135,6 @@ func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePref
 		conn:       conn,
 		classifier: errorClassifier{translator: translator, prefs: prefs},
 		daemonAddr: daemonAddr,
-		elevator:   osElevator{},
 	}
 }
 
@@ -191,10 +180,10 @@ func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error
 	}, nil
 }
 
-func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) (SaveOutcome, error) {
+func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
-		return SaveOutcome{}, err
+		return err
 	}
 	req := &proto.SetConfigRequest{
 		ProfileName:                   p.ProfileName,
@@ -226,92 +215,19 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) (SaveOutcom
 		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
 	}
 	if _, err := cli.SetConfig(ctx, req); err != nil {
-		if _, refused := privilegeErrorInfo(err); refused {
-			return s.setConfigElevated(ctx, p, req, err)
-		}
 		// Classified so the frontend gets the daemon's guidance instead of the
-		// gRPC envelope.
-		return SaveOutcome{}, s.classifier.classify(err)
+		// gRPC envelope, which is what a refused privileged change looks like.
+		return s.classifier.classify(err)
 	}
-	return SaveOutcome{}, nil
-}
-
-// setConfigElevated answers a request the daemon refused for want of privileges by
-// asking the user to authorize it, and sending it again if they do. It is the same
-// offer the SSH settings make up front, for the changes a control cannot know are
-// guarded until it is told: repointing a profile at another management server is
-// only privileged while that host runs the SSH server.
-//
-// Two steps, because the elevated one-shot deliberately understands only the
-// settings the daemon guards: it applies those, and the original request then goes
-// through as this user, its privileged parts now asking for nothing that is not
-// already stored. Nothing was applied by the refused attempt — the daemon decides
-// before it writes — so there is no half-applied state to undo either way.
-func (s *Settings) setConfigElevated(ctx context.Context, p SetConfigParams, req *proto.SetConfigRequest, refusal error) (SaveOutcome, error) {
-	if !s.canElevate() {
-		return SaveOutcome{}, s.classifier.classify(refusal)
-	}
-
-	guarded, err := s.guardedChanges(ctx, p)
-	if err != nil {
-		log.Warnf("cannot tell which guarded settings this request changes: %v", err)
-		return SaveOutcome{}, s.classifier.classify(refusal)
-	}
-	if len(guardedSettings(guarded)) == 0 {
-		// Refused over something no prompt can settle, such as a control channel
-		// that carries no caller identity. Report the daemon's own guidance.
-		return SaveOutcome{}, s.classifier.classify(refusal)
-	}
-
-	outcome, err := s.SetGuardedSettings(ctx, guarded)
-	if err != nil || outcome.Declined {
-		return outcome, err
-	}
-
-	cli, err := s.conn.Client()
-	if err != nil {
-		return SaveOutcome{}, err
-	}
-	if _, err := cli.SetConfig(ctx, req); err != nil {
-		return SaveOutcome{}, s.classifier.classify(err)
-	}
-	return SaveOutcome{}, nil
-}
-
-// guardedChanges is the guarded part of a request, reduced to what it actually
-// changes.
-//
-// A settings form submits every field it holds, so a request restates values the
-// daemon already has. Carrying those into the elevated run would spend one
-// authorization on more than the user asked for, and a value that has gone stale
-// since the form was loaded would spend it on something they never asked about.
-func (s *Settings) guardedChanges(ctx context.Context, p SetConfigParams) (GuardedSettings, error) {
-	stored, err := s.GetConfig(ctx, ConfigParams{ProfileName: p.ProfileName, Username: p.Username})
-	if err != nil {
-		return GuardedSettings{}, fmt.Errorf("read the stored config: %w", err)
-	}
-
-	guarded := GuardedSettings{
-		ProfileName:      p.ProfileName,
-		Username:         p.Username,
-		ServerSSHAllowed: changedFlag(p.ServerSSHAllowed, stored.ServerSSHAllowed),
-		EnableSSHRoot:    changedFlag(p.EnableSSHRoot, stored.EnableSSHRoot),
-		DisableSSHAuth:   changedFlag(p.DisableSSHAuth, stored.DisableSSHAuth),
-	}
-	// An empty URL leaves the setting alone, which is the daemon's rule too.
-	if p.ManagementURL != "" && p.ManagementURL != stored.ManagementURL {
-		guarded.ManagementURL = p.ManagementURL
-	}
-	return guarded, nil
+	return nil
 }
 
 // Privilege reports whether this UI process could carry out the changes the
-// daemon restricts to root/administrator, whether it can instead ask the
-// operating system for the privileges when the user wants one of them, and the
-// command that performs the ones users hit in the SSH settings. It applies the
-// daemon's own rule to what it can see locally, so the frontend can decide up
-// front how to present those controls instead of letting a save fail. No daemon
-// round-trip, so it also works while the daemon is down.
+// daemon restricts to root/administrator, and the command that performs the one
+// users hit in the SSH settings. It applies the daemon's own rule to what it can
+// see locally, so the frontend can present those controls as unavailable up front
+// instead of letting a save fail. No daemon round-trip, so it also works while the
+// daemon is down.
 //
 // Being root or an elevated administrator is one way. The other is running as the
 // daemon's own user while the daemon is unprivileged, which the daemon accepts
@@ -321,40 +237,26 @@ func (s *Settings) guardedChanges(ctx context.Context, p SetConfigParams) (Guard
 func (s *Settings) Privilege() Privilege {
 	id, err := ipcauth.CurrentProcessIdentity()
 	if err != nil {
-		// Fail closed: report unprivileged, which only ever asks for more.
+		// Fail closed: report unprivileged, which only ever disables controls.
 		log.Warnf("cannot read this process's identity, treating it as unprivileged: %v", err)
-		return s.newPrivilege(false)
+		return newPrivilege(false)
 	}
 	if id.IsPrivileged() {
-		return s.newPrivilege(true)
+		return newPrivilege(true)
 	}
-	return s.newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
+	return newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
 }
 
-func (s *Settings) newPrivilege(privileged bool) Privilege {
+func newPrivilege(privileged bool) Privilege {
 	return Privilege{
 		Privileged:     privileged,
-		ActorKey:       ipcauth.PrivilegedActorKey(),
-		CanElevate:     s.canElevate(),
+		Actor:          ipcauth.PrivilegedActor(),
 		AllowSSHServer: ipcauth.UpCommand("--allow-server-ssh"),
 		EnableSSHRoot:  ipcauth.UpCommand("--enable-ssh-root"),
 		DisableSSHAuth: ipcauth.UpCommand("--disable-ssh-auth"),
 	}
 }
 
-// canElevate reports whether offering the platform's elevation prompt would get
-// the user anywhere. It needs a mechanism to raise the prompt with and a control
-// channel that tells the daemon who is calling: on loopback TCP the daemon
-// refuses these changes to everybody, root included, so a prompt there would
-// only waste the user's password.
-func (s *Settings) canElevate() bool {
-	if !daemonaddr.CarriesIdentity(s.daemonAddr) {
-		log.Debugf("not offering elevation: the daemon address %s carries no caller identity", s.daemonAddr)
-		return false
-	}
-	return s.elevator.Available()
-}
-
 func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -387,15 +289,6 @@ func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
 	return r, nil
 }
 
-// changedFlag returns requested only when it differs from what is stored, so a
-// setting the request merely restates is left out of the elevated run.
-func changedFlag(requested *bool, stored bool) *bool {
-	if requested == nil || *requested == stored {
-		return nil
-	}
-	return requested
-}
-
 func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
 	managed := cfgResp.GetMDMManagedFields()
 	if len(managed) == 0 {

client/ui/tray.go

@@ -26,7 +26,6 @@ const (
 	notifyIDUpdatePrefix = "netbird-update-"
 	notifyIDEvent        = "netbird-event-"
 	notifyIDTrayError    = "netbird-tray-error"
-	notifyIDMDMPolicy    = "netbird-mdm-policy"
 
 	statusError = "Error"
 
@@ -44,7 +43,7 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *Notifier
+	Notifier        *notifications.NotificationService
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager

client/ui/tray_click_linux.go

@@ -4,26 +4,17 @@ package main
 
 // bindTrayClick wires the tray icon's left-click handler on Linux.
 //
-// Expected behaviour per tray host:
-//
-//	Host                           Left click              Right click
-//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
-//	GNOME Shell + AppIndicator     menu only               menu only
-//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
-//
-// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
-// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
-// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
-//
-// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
-// on ANY click and only reports the menu opening via dbusmenu
-// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
-// both buttons raised the main window on top of the menu, and on KDE/Waybar
-// a right click raised it over the freshly opened menu. The netbirdio/wails
-// fork (go.mod replace) drops that heuristic: a menu open never fires
-// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
-// entry; left-click-opens-window is not achievable there anyway, since the
-// host always opens the menu itself.
+// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
+// fires the registered clickHandler:
+//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
+//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
+//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
+//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
+//     call itself (xembed_host_linux.go), so it routes through the same hook.
+// Registering OnClick here therefore covers both paths with one handler — no
+// changes to the watcher or XEmbed C code are needed. Left-click now opens the
+// main window; right-click still opens the menu via Wails' default
+// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
 //
 // We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
 // (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's

client/ui/tray_events.go

@@ -21,32 +21,14 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	if !ok {
 		return
 	}
-	// config_changed carries no UserMessage, so handle it before the message gate below.
+	// config_changed carries no user-facing message, so handle it before the gate below.
 	if se.Category == "system" && se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypeConfigChanged {
 		log.Infof("config_changed event received (source=%s); refreshing tray restrictions", se.Metadata[proto.MetadataSourceKey])
 		go t.refreshRestrictions()
 		go t.loadConfig()
-		// MDM gets a localised toast here; the daemon's English "policy_applied"
-		// event is suppressed in shouldSkipSystemEvent. Other sources stay silent.
-		if se.Metadata[proto.MetadataSourceKey] == proto.MetadataSourceMDM {
-			t.profileMu.Lock()
-			enabled := t.notificationsEnabled
-			t.profileMu.Unlock()
-			if enabled {
-				t.notify(
-					t.loc.T("notify.mdm.policyApplied.title"),
-					t.loc.T("notify.mdm.policyApplied.body"),
-					notifyIDMDMPolicy,
-				)
-			}
-		}
 		return
 	}
-	// Session-warning and deadline-rejected events build their body locally from
-	// metadata; every other event needs a UserMessage.
-	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
-	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
-	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
+	if se.MessageKey == "" && se.UserMessage == "" {
 		return
 	}
 	if shouldSkipSystemEvent(se) {
@@ -61,56 +43,56 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 		return
 	}
 
-	// Session-warning events route via stable metadata flags rather than
-	// category/severity so a daemon-side reword still lands here. Final warning
-	// auto-opens the SessionExpiration dialog with no notification (the dialog is
-	// the last-chance reminder; doubling up would be noise).
-	if isDeadlineRejected {
-		t.notify(
-			t.loc.T("notify.sessionDeadlineRejected.title"),
-			t.loc.T("notify.sessionDeadlineRejected.body"),
-			notifyIDSessionExpired,
-		)
-		return
-	}
+	body := t.localizedEventMessage(se)
 
-	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
+	// The final session warning auto-opens the SessionExpiration dialog instead of
+	// toasting: the dialog is the last-chance reminder and doubling up would be
+	// noise. This routes on metadata rather than the message key because it is a
+	// behavioural distinction, not a wording one.
+	if se.Metadata[authsession.MetaWarning] == "true" {
 		if se.Metadata[authsession.MetaFinal] == "true" {
 			t.openSessionExpiration()
 			return
 		}
-		t.notifySessionWarning(
-			t.loc.T("notify.sessionWarning.title"),
-			t.buildSessionWarningBody(se.Metadata),
-		)
+		t.notifySessionWarning(t.eventTitle(se), body)
 		return
 	}
 
-	body := se.UserMessage
 	if id := se.Metadata["id"]; id != "" {
 		body += fmt.Sprintf(" ID: %s", id)
 	}
-	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
+	t.notify(t.eventTitle(se), body, notifyIDEvent+se.ID)
 }
 
-// eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
-func eventTitle(e services.SystemEvent) string {
-	prefix := titleCase(e.Severity)
-	if prefix == "" {
-		prefix = "Info"
+// localizedEventMessage resolves the daemon's message key against the active
+// locale. A key this build does not ship — a daemon newer than the UI — falls
+// back to the daemon's own English rendering rather than showing a bare key.
+func (t *Tray) localizedEventMessage(se services.SystemEvent) string {
+	if body, ok := t.loc.Lookup(se.MessageKey, se.MessageArgs); ok {
+		return body
 	}
-	category := titleCase(e.Category)
-	if category == "" {
-		category = "System"
+	if se.MessageKey != "" {
+		log.Debugf("no translation for event message key %q, using the daemon's text", se.MessageKey)
 	}
-	return prefix + ": " + category
+	return se.UserMessage
 }
 
-func titleCase(s string) string {
-	if s == "" {
-		return ""
+// eventTitle resolves the event's own title key, falling back to a title
+// composed from severity and category, e.g. "Critical: DNS" in English. An enum
+// value this build does not know falls back to the Info and System labels.
+func (t *Tray) eventTitle(se services.SystemEvent) string {
+	if title, ok := t.loc.Lookup(se.TitleKey, nil); ok {
+		return title
 	}
-	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+	severity, ok := t.loc.Lookup("event.severity."+strings.ToLower(se.Severity), nil)
+	if !ok {
+		severity = t.loc.T("event.severity.info")
+	}
+	category, ok := t.loc.Lookup("event.category."+strings.ToLower(se.Category), nil)
+	if !ok {
+		category = t.loc.T("event.category.system")
+	}
+	return t.loc.T("event.title", "severity", severity, "category", category)
 }
 
 // shouldSkipSystemEvent reports whether a daemon SystemEvent must not surface as
@@ -119,11 +101,6 @@ func titleCase(s string) string {
 //   - install-progress signals (consumed by the install-progress window)
 //   - the ::/0 partner of an exit-node default route (0.0.0.0/0 already toasted)
 func shouldSkipSystemEvent(se services.SystemEvent) bool {
-	// "policy_applied" carries a hardcoded English message; the localised toast
-	// fires on the paired config_changed (source=mdm) event instead.
-	if se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypePolicyApplied {
-		return true
-	}
 	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
 		return true
 	}

client/ui/tray_events_test.go

@@ -0,0 +1,150 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// trayWithLocalizer builds the minimum Tray the message/title resolvers touch:
+// they read t.loc and nothing else, so no app, window or daemon connection is
+// needed. The shipped locale tree is used so the assertions below exercise the
+// real bundles rather than a fixture.
+func trayWithLocalizer(t *testing.T) *Tray {
+	t.Helper()
+	bundle, err := i18n.NewBundle(os.DirFS("i18n/locales"))
+	require.NoError(t, err, "the shipped locale tree must load")
+	return &Tray{loc: NewLocalizer(bundle, nil)}
+}
+
+func TestLocalizedEventMessageResolvesKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey: string(proto.UserMsgExitNodeConnected),
+		// A daemon always ships its English rendering too; the key must win.
+		UserMessage: "should not be used",
+	})
+	assert.Equal(t, "Exit node connected.", got)
+}
+
+func TestLocalizedEventMessageSubstitutesArgs(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey:  string(proto.UserMsgUpdateCompleted),
+		MessageArgs: map[string]string{proto.ArgVersion: "0.60.1"},
+	})
+	assert.Equal(t, "Your NetBird client was auto-updated to version 0.60.1.", got)
+}
+
+// A daemon newer than the UI can publish a key this build has never heard of.
+// Showing the raw key would be a visible regression, so the daemon's own English
+// text has to win instead.
+func TestLocalizedEventMessageFallsBackToDaemonText(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey:  "event.somethingThisBuildNeverHeardOf",
+		UserMessage: "A message from a newer daemon.",
+	})
+	assert.Equal(t, "A message from a newer daemon.", got)
+}
+
+// An old daemon sends no key at all, only userMessage.
+func TestLocalizedEventMessageWithoutKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{UserMessage: "Legacy English text."})
+	assert.Equal(t, "Legacy English text.", got)
+}
+
+func TestEventTitlePrefersTitleKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.eventTitle(services.SystemEvent{
+		Severity: "critical",
+		Category: "authentication",
+		TitleKey: string(proto.TitleSessionWarning),
+	})
+	assert.Equal(t, "Session expires soon", got, "a title key must beat the composed title")
+}
+
+func TestEventTitleComposesFromSeverityAndCategory(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	tests := []struct {
+		name     string
+		severity string
+		category string
+		want     string
+	}{
+		{"warning dns", "warning", "dns", "Warning: DNS"},
+		{"critical system", "critical", "system", "Critical: System"},
+		{"info network", "info", "network", "Info: Network"},
+		{"error authentication", "error", "authentication", "Error: Authentication"},
+		// Enum values this build does not know, and the empty severity/category
+		// an event carries before the daemon fills them in.
+		{"unknown severity", "apocalyptic", "dns", "Info: DNS"},
+		{"unknown category", "warning", "quantum", "Warning: System"},
+		{"empty", "", "", "Info: System"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tray.eventTitle(services.SystemEvent{Severity: tc.severity, Category: tc.category})
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestShouldSkipSystemEvent(t *testing.T) {
+	tests := []struct {
+		name string
+		ev   services.SystemEvent
+		want bool
+	}{
+		{
+			name: "update announcement handled by the tray updater",
+			ev:   services.SystemEvent{Metadata: map[string]string{"new_version_available": "0.60.1"}},
+			want: true,
+		},
+		{
+			name: "install progress belongs to the progress window",
+			ev:   services.SystemEvent{Metadata: map[string]string{"progress_window": "show"}},
+			want: true,
+		},
+		{
+			name: "the v6 half of a dual-stack default route is already toasted as v4",
+			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "::/0"}},
+			want: true,
+		},
+		{
+			name: "the v4 default route is the one that toasts",
+			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "0.0.0.0/0"}},
+			want: false,
+		},
+		{
+			// policy_applied used to be suppressed here while the tray toasted
+			// off the paired config_changed event; it now carries its own keys.
+			name: "mdm policy applied surfaces normally",
+			ev: services.SystemEvent{
+				MessageKey: string(proto.UserMsgMDMPolicyApplied),
+				Metadata:   map[string]string{proto.MetadataTypeKey: proto.MetadataTypePolicyApplied},
+			},
+			want: false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, shouldSkipSystemEvent(tc.ev))
+		})
+	}
+}

client/ui/tray_notify.go

@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)

client/ui/tray_session.go

@@ -10,8 +10,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
-	nbstatus "github.com/netbirdio/netbird/client/status"
-	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/services"
 )
 
@@ -27,10 +25,11 @@ const (
 	finalWarningCountdownSeconds = 120
 )
 
-// handleSessionExpired notifies and brings the window forward so the user can reconnect.
+// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
 	if t.window != nil {
+		t.window.SetURL("/#/login")
 		t.window.Show()
 		t.window.Focus()
 	}
@@ -195,25 +194,6 @@ func (t *Tray) registerSessionWarningCategory() {
 	})
 }
 
-// buildSessionWarningBody composes the localised notification body from the daemon's metadata.
-// The daemon has no locale, so it ships an RFC3339 deadline the tray turns into a user-language sentence.
-// Falls back to a generic string when metadata is missing or unparsable.
-func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
-	if meta == nil {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	raw := meta[authsession.MetaExpiresAt]
-	if raw == "" {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	deadline, err := authsession.ParseExpiresAt(raw)
-	if err != nil {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
-	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
-}
-
 // notifySessionWarning sends the interactive expiry notification, falling back to plain notify when the
 // with-actions variant is unavailable (older platform impls, or a bare Notifier in tests).
 func (t *Tray) notifySessionWarning(title, body string) {
@@ -307,7 +287,11 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.app.Event.Emit(services.EventTriggerLogin)
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
 		return
 	}
 	if t.svc.WindowManager == nil {

client/ui/tray_update.go

@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *Notifier
+	notifier     *notifications.NotificationService
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,

e2e/agentnetwork/management_test.go

@@ -160,19 +160,8 @@ func TestSettingsRoundTrip(t *testing.T) {
 	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
 	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
-	// A cluster different from the pinned one must be rejected; echoing the
-	// pinned one back is valid.
-	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr("attacker.cluster.invalid"),
-		EnableLogCollection:    before.EnableLogCollection,
-		EnablePromptCollection: before.EnablePromptCollection,
-		RedactPii:              before.RedactPii,
-	})
-	requireClientError(t, err)
-
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(before.Cluster),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,