Merge branch 'main' into sync-tag-dashboard

.github/workflows/sync-tag.yml

@@ -37,3 +37,16 @@ jobs:
           repo: netbirdio/ios-client
           token: ${{ secrets.NC_GITHUB_TOKEN }}
           inputs: '{ "tag": "${{ github.ref_name }}" }'
+
+  trigger_dashboard_bump:
+    runs-on: ubuntu-latest
+    if: github.event.created && !github.event.deleted && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
+    steps:
+      - name: Trigger dashboard wasm client bump
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: bump-netbird.yml
+          ref: main
+          repo: netbirdio/dashboard
+          token: ${{ secrets.NC_GITHUB_TOKEN }}
+          inputs: '{ "tag": "${{ github.ref_name }}" }'

client/embed/embed.go

@@ -91,6 +91,13 @@ type Options struct {
 	// when the embedded client must never act as a stepping stone into
 	// the host's local network (e.g. the proxy's overlay peer).
 	BlockLANAccess bool
+	// LazyConnectionEnabled is a tri-state local override for lazy connections,
+	// mirroring the NB_LAZY_CONN env var. Nil defers to the management feature
+	// flag; a set value overrides it in both directions. A short-lived client
+	// that reaches only a few known peers can set this to false, so its peers
+	// connect eagerly and the first request does not wait for the connection to
+	// be established.
+	LazyConnectionEnabled *bool
 	// WireguardPort is the port for the tunnel interface. Use 0 for a random port.
 	WireguardPort *int
 	// MTU is the MTU for the tunnel interface.
@@ -220,6 +227,15 @@ func New(opts Options) (*Client, error) {
 		config.PrivateKey = opts.PrivateKey
 	}
 
+	if opts.LazyConnectionEnabled != nil {
+		// Runtime-only override, read back through lazyconn.ParseState; a set value
+		// wins over the management feature flag in both directions.
+		config.LazyConnection = "off"
+		if *opts.LazyConnectionEnabled {
+			config.LazyConnection = "on"
+		}
+	}
+
 	if opts.Performance.PreallocatedBuffersPerPool != nil {
 		wgdevice.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
 	}

client/system/info_js.go

@@ -15,7 +15,7 @@ func UpdateStaticInfoAsync() {
 }
 
 // GetInfo retrieves system information for WASM environment
-func GetInfo(_ context.Context) *Info {
+func GetInfo(ctx context.Context) *Info {
 	info := &Info{
 		GoOS:           runtime.GOOS,
 		Kernel:         runtime.GOARCH,
@@ -30,6 +30,13 @@ func GetInfo(_ context.Context) *Info {
 	collectBrowserInfo(info)
 	collectLocationInfo(info)
 	collectSystemInfo(info)
+
+	// A caller-provided device name wins, as on the other platforms. A peer
+	// registered over an API keeps reporting the name it was registered with,
+	// so its meta does not change on the first sync.
+	if name := extractDeviceName(ctx, info.Hostname); name != "" {
+		info.Hostname = name
+	}
 	return info
 }
 

client/system/info_js_test.go

@@ -0,0 +1,27 @@
+//go:build js
+
+package system
+
+import (
+	"context"
+	"testing"
+)
+
+// TestGetInfoHonorsDeviceName covers a caller-provided device name reaching the
+// reported hostname, so a peer registered over an API keeps reporting the name
+// it was registered with instead of renaming itself on its first sync.
+func TestGetInfoHonorsDeviceName(t *testing.T) {
+	ctx := context.WithValue(context.Background(), DeviceNameCtxKey, "session-name")
+	if got := GetInfo(ctx).Hostname; got != "session-name" {
+		t.Errorf("hostname should carry the caller's device name, got %q", got)
+	}
+}
+
+// TestGetInfoWithoutDeviceNameKeepsFallback covers the embed layer's habit of
+// always setting the context value: an empty name must not blank the hostname.
+func TestGetInfoWithoutDeviceNameKeepsFallback(t *testing.T) {
+	ctx := context.WithValue(context.Background(), DeviceNameCtxKey, "")
+	if got := GetInfo(ctx).Hostname; got == "" {
+		t.Error("an empty device name must not blank the hostname")
+	}
+}

client/system/process_test.go

@@ -1,3 +1,5 @@
+//go:build windows || (linux && !android) || (darwin && !ios) || freebsd
+
 package system
 
 import (

client/ui/i18n/locales/de/common.json

@@ -764,7 +764,19 @@
         "message": "Sensible Informationen anonymisieren"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Versteckt öffentliche IP-Adressen und nicht-NetBird-Domains in Logs."
+        "message": "Verbirgt IP-Adressen, Domains und andere sensible Werte."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Der Standardmodus lässt interne IPv4-Adressen und Peer-Namen für den Support lesbar. Der strikte Modus anonymisiert zusätzlich private (RFC 1918), CGNAT- und Link-Local-IP-Adressen, Peer-Namen und öffentliche WireGuard-Schlüssel. Wiederkehrende Werte erhalten denselben Platzhalter, sodass Peers unterscheidbar bleiben. Verwenden Sie den strikten Modus, wenn Sie das Debug-Paket außerhalb Ihrer Organisation weitergeben."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Keine"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Standard"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strikt"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Systeminformationen einschließen"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Sie können dies deaktivieren, aber zum erneuten Aktivieren sind {actor} erforderlich:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Sie können dies aktivieren, aber zum erneuten Deaktivieren sind {actor} erforderlich:"
     }
 }

client/ui/i18n/locales/es/common.json

@@ -764,7 +764,19 @@
         "message": "Anonimizar información sensible"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Oculta las direcciones IP públicas y los dominios ajenos a NetBird de los registros."
+        "message": "Oculta direcciones IP, dominios y otros valores sensibles."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "El modo predeterminado mantiene legibles las direcciones IPv4 internas y los nombres de los peers para el soporte. El modo estricto anonimiza además las direcciones IP privadas (RFC 1918), CGNAT y de enlace local, los nombres de los peers y las claves públicas de WireGuard. Los valores recurrentes se asignan al mismo marcador de posición, por lo que los peers siguen siendo distinguibles. Use el modo estricto cuando comparta el paquete de diagnóstico fuera de su organización."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Ninguno"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predeterminado"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estricto"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Incluir información del sistema"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "La operación falló."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requiere {actor}. Ejecute esto en su lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}:"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -764,7 +764,19 @@
         "message": "Anonymiser les informations sensibles"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Masque les adresses IP publiques et les domaines non-NetBird dans les journaux."
+        "message": "Masque les adresses IP, les domaines et d'autres valeurs sensibles."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Le mode par défaut garde les adresses IPv4 internes et les noms des pairs lisibles pour le support. Le mode strict anonymise en plus les adresses IP privées (RFC 1918), CGNAT et de lien local, les noms des pairs et les clés publiques WireGuard. Les valeurs récurrentes reçoivent le même espace réservé, les pairs restent donc distinguables. Utilisez le mode strict lorsque vous partagez le lot de diagnostic en dehors de votre organisation."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Aucune"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Par défaut"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strict"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Inclure les informations système"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor} :"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor} :"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -764,7 +764,19 @@
         "message": "Érzékeny információk anonimizálása"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Elrejti a nyilvános IP-címeket és a nem-NetBird tartományokat a naplókban."
+        "message": "Elrejti az IP-címeket, a tartományokat és más érzékeny értékeket."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Az Alapértelmezett szint a belső IPv4-címeket és a peer-neveket olvashatóan hagyja a támogatás számára. A Szigorú ezen felül anonimizálja a privát (RFC 1918), CGNAT és link-local IP-címeket, a peer-neveket és a WireGuard nyilvános kulcsokat. Az ismétlődő értékek ugyanazt a helyettesítőt kapják, így a peerek megkülönböztethetők maradnak. Használja a Szigorú szintet, ha a hibakeresési csomagot a szervezetén kívül osztja meg."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nincs"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Alapértelmezett"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Szigorú"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Rendszerinformációk beillesztése"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges:"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -764,7 +764,19 @@
         "message": "Anonimizza informazioni sensibili"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Nasconde gli indirizzi IP pubblici e i domini non NetBird dai log."
+        "message": "Nasconde indirizzi IP, domini e altri valori sensibili."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "La modalità predefinita mantiene leggibili gli indirizzi IPv4 interni e i nomi dei peer per il supporto. La modalità rigorosa anonimizza inoltre gli indirizzi IP privati (RFC 1918), CGNAT e link-local, i nomi dei peer e le chiavi pubbliche WireGuard. I valori ricorrenti vengono associati allo stesso segnaposto, quindi i peer restano distinguibili. Usa la modalità rigorosa quando condividi il pacchetto di debug al di fuori della tua organizzazione."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nessuna"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predefinito"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Rigoroso"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Includi informazioni di sistema"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Richiede {actor}. Esegua invece questo:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}:"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -764,7 +764,19 @@
         "message": "機密情報を匿名化"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "ログからパブリック IP アドレスと NetBird 以外のドメインを隠します。"
+        "message": "IP アドレス、ドメイン、その他の機密性の高い値を隠します。"
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "「デフォルト」では、サポートのために内部 IPv4 アドレスとピア名は読める状態のまま残ります。「厳格」では、さらにプライベート (RFC 1918)、CGNAT、リンクローカルの IP アドレス、ピア名、WireGuard 公開鍵も匿名化されます。繰り返し現れる値は同じプレースホルダーに置き換えられるため、ピアは区別できます。デバッグバンドルを組織外に共有する場合は「厳格」を使用してください。"
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "なし"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "デフォルト"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "厳格"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "システム情報を含める"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "無効にはできますが、再度有効にするには{actor}が必要です:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "有効にはできますが、再度無効にするには{actor}が必要です:"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -764,7 +764,19 @@
         "message": "Anonimizar informações sensíveis"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Oculta endereços IP públicos e domínios que não são do NetBird nos logs."
+        "message": "Oculta endereços IP, domínios e outros valores sensíveis."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "O modo padrão mantém os endereços IPv4 internos e os nomes dos peers legíveis para o suporte. O modo estrito anonimiza também os endereços IP privados (RFC 1918), CGNAT e link-local, os nomes dos peers e as chaves públicas do WireGuard. Valores recorrentes recebem o mesmo marcador, então os peers continuam distinguíveis. Use o modo estrito ao compartilhar o pacote de depuração fora da sua organização."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nenhum"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Padrão"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estrito"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Incluir informações do sistema"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requer {actor}. Execute isto em vez disso:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Você pode desativar isto, mas ativar novamente requer {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Você pode ativar isto, mas desativar novamente requer {actor}:"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -764,7 +764,19 @@
         "message": "Анонимизировать конфиденциальную информацию"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Скрывает публичные IP-адреса и сторонние (не относящиеся к NetBird) домены в журналах."
+        "message": "Скрывает IP-адреса, домены и другие конфиденциальные значения."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Режим «По умолчанию» оставляет внутренние IPv4-адреса и имена пиров читаемыми для поддержки. Режим «Строгий» дополнительно анонимизирует частные (RFC 1918), CGNAT и link-local IP-адреса, имена пиров и публичные ключи WireGuard. Повторяющиеся значения заменяются одним и тем же заполнителем, поэтому пиры остаются различимыми. Используйте режим «Строгий», когда передаёте отладочный пакет за пределы вашей организации."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Нет"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "По умолчанию"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Строгий"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Включить сведения о системе"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Требуются {actor}. Выполните вместо этого:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Отключить можно, но чтобы включить снова, нужны {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Включить можно, но чтобы отключить снова, нужны {actor}:"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -764,7 +764,19 @@
         "message": "匿名化敏感信息"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "从日志中隐藏公共 IP 地址和非 NetBird 域名。"
+        "message": "隐藏 IP 地址、域名和其他敏感值。"
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "默认级别保留内部 IPv4 地址和对等节点名称，便于支持人员阅读。严格级别还会匿名化私有 (RFC 1918)、CGNAT 和链路本地 IP 地址、对等节点名称以及 WireGuard 公钥。相同的值会映射到相同的占位符，因此对等节点仍可区分。向组织外部分享调试包时请使用严格级别。"
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "无"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "默认"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "严格"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "包含系统信息"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "操作失败。"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "需要{actor}。请改为运行："
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "您可以关闭此项，但重新开启需要{actor}："
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "您可以开启此项，但再次关闭需要{actor}："
     }
 }

client/wasm/cmd/main.go

@@ -56,8 +56,7 @@ func startClient(ctx context.Context, nbClient *netbird.Client) error {
 // parseClientOptions extracts NetBird options from JavaScript object
 func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 	options := netbird.Options{
-		DeviceName: "dashboard-client",
-		LogLevel:   defaultLogLevel,
+		LogLevel: defaultLogLevel,
 	}
 
 	if jwtToken := jsOptions.Get("jwtToken"); !jwtToken.IsNull() && !jwtToken.IsUndefined() {
@@ -87,13 +86,41 @@ func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 		options.DeviceName = deviceName.String()
 	}
 
-	if disableIPv6 := jsOptions.Get("disableIPv6"); !disableIPv6.IsNull() && !disableIPv6.IsUndefined() {
-		options.DisableIPv6 = disableIPv6.Bool()
+	disableIPv6, err := boolOption(jsOptions, "disableIPv6")
+	if err != nil {
+		return options, err
+	}
+	if disableIPv6 != nil {
+		options.DisableIPv6 = *disableIPv6
 	}
 
+	// The caller decides whether this client uses lazy connections; left unset it
+	// defers to the management feature flag. A short-lived, interactive caller
+	// turns it off so its sessions reach the few peers their grant covers eagerly,
+	// instead of the first request waiting for the connection to be established.
+	lazyConnectionEnabled, err := boolOption(jsOptions, "lazyConnectionEnabled")
+	if err != nil {
+		return options, err
+	}
+	options.LazyConnectionEnabled = lazyConnectionEnabled
+
 	return options, nil
 }
 
+// boolOption reads a boolean option, returning nil when the caller left it out.
+// js.Value.Bool panics on any other type, so a wrong type is reported instead.
+func boolOption(jsOptions js.Value, name string) (*bool, error) {
+	v := jsOptions.Get(name)
+	if v.IsNull() || v.IsUndefined() {
+		return nil, nil
+	}
+	if v.Type() != js.TypeBoolean {
+		return nil, fmt.Errorf("option %s must be a boolean, got %s", name, v.Type())
+	}
+	b := v.Bool()
+	return &b, nil
+}
+
 // createStartMethod creates the start method for the client
 func createStartMethod(client *netbird.Client) js.Func {
 	return js.FuncOf(func(this js.Value, args []js.Value) any {

client/wasm/cmd/main_test.go

@@ -0,0 +1,64 @@
+//go:build js
+
+package main
+
+import (
+	"syscall/js"
+	"testing"
+)
+
+// TestParseClientOptionsBooleans covers the boolean options against the value
+// kinds a JS caller can pass: js.Value.Bool panics on anything but a boolean,
+// so a wrong type has to be rejected before it reaches the client.
+func TestParseClientOptionsBooleans(t *testing.T) {
+	t.Run("unset leaves the lazy override empty", func(t *testing.T) {
+		options, err := parseClientOptions(js.Global().Get("Object").New())
+		if err != nil {
+			t.Fatalf("parse options: %v", err)
+		}
+		if options.LazyConnectionEnabled != nil {
+			t.Errorf("lazy override should stay unset, got %v", *options.LazyConnectionEnabled)
+		}
+		if options.DisableIPv6 {
+			t.Error("disableIPv6 should default to false")
+		}
+	})
+
+	t.Run("null defers to the management flag", func(t *testing.T) {
+		jsOptions := js.Global().Get("Object").New()
+		jsOptions.Set("lazyConnectionEnabled", js.Null())
+		options, err := parseClientOptions(jsOptions)
+		if err != nil {
+			t.Fatalf("parse options: %v", err)
+		}
+		if options.LazyConnectionEnabled != nil {
+			t.Errorf("lazy override should stay unset, got %v", *options.LazyConnectionEnabled)
+		}
+	})
+
+	t.Run("booleans are carried through", func(t *testing.T) {
+		jsOptions := js.Global().Get("Object").New()
+		jsOptions.Set("lazyConnectionEnabled", false)
+		jsOptions.Set("disableIPv6", true)
+		options, err := parseClientOptions(jsOptions)
+		if err != nil {
+			t.Fatalf("parse options: %v", err)
+		}
+		if options.LazyConnectionEnabled == nil || *options.LazyConnectionEnabled {
+			t.Errorf("lazy override should be false, got %v", options.LazyConnectionEnabled)
+		}
+		if !options.DisableIPv6 {
+			t.Error("disableIPv6 should be true")
+		}
+	})
+
+	t.Run("a non-boolean is rejected", func(t *testing.T) {
+		for _, value := range []any{"true", 1, js.Global().Get("Object").New()} {
+			jsOptions := js.Global().Get("Object").New()
+			jsOptions.Set("lazyConnectionEnabled", value)
+			if _, err := parseClientOptions(jsOptions); err == nil {
+				t.Errorf("value %v should be rejected", value)
+			}
+		}
+	})
+}

management/server/peer.go

@@ -1066,18 +1066,6 @@ func (am *DefaultAccountManager) SyncPeer(ctx context.Context, sync types.PeerSy
 
 	metaDiffAffectsPosture := posture.AffectsPosture(ctx, &metaDiff, resPostureChecks)
 	if requiresPeerUpdate(ctx, isStatusChanged, sync.UpdateAccountPeers, ipv6CapabilityChanged, metaDiffAffectsPosture, metaDiff.VersionChanged(), metaDiff.HostnameChanged()) {
-		// The maps sent out below carry changed content (the peer's version,
-		// hostname, capabilities, or validation state). The serial versions the
-		// distributed map, so it must advance with the content.
-		if err = am.Store.IncrementNetworkSerial(ctx, accountID); err != nil {
-			return nil, nil, nil, 0, fmt.Errorf("increment network serial: %w", err)
-		}
-		// The map built above predates the increment; rebuild it so the syncing
-		// peer's own response also carries the advanced serial.
-		nmap, resPostureChecks, dnsFwdPort, err = am.networkMapController.GetValidatedPeerWithMap(ctx, peerNotValid, accountID, peer.ID)
-		if err != nil {
-			return nil, nil, nil, 0, err
-		}
 		changedPeerIDs := []string{peer.ID}
 		affectedPeerIDs := am.syncPeerAffectedPeers(ctx, accountID, peer.ID, nmap, peerNotValid, metaDiffAffectsPosture)
 		if err = am.networkMapController.OnPeersUpdated(ctx, accountID, changedPeerIDs, affectedPeerIDs); err != nil {
@@ -1242,16 +1230,6 @@ func (am *DefaultAccountManager) LoginPeer(ctx context.Context, login types.Peer
 		return nil, nil, nil, false, err
 	}
 
-	if shouldUpdatePeers {
-		// The maps sent out below carry changed peer content. The serial versions
-		// the distributed map, so it must advance with the content, and before the
-		// network is loaded for the response so the logging-in peer also sees the
-		// advanced serial.
-		if err = am.Store.IncrementNetworkSerial(ctx, accountID); err != nil {
-			return nil, nil, nil, false, fmt.Errorf("increment network serial: %w", err)
-		}
-	}
-
 	network, postureChecks, enableSSH, err := getPeerLoginInfo(ctx, am.Store, accountID, peer, !isRequiresApproval)
 	if err != nil {
 		return nil, nil, nil, false, err

management/server/peer_test.go

@@ -16,11 +16,11 @@ import (
 	"testing"
 	"time"
 
+	"go.uber.org/mock/gomock"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
 	"golang.org/x/exp/maps"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
@@ -2828,104 +2828,6 @@ func TestSyncPeer_IPv6CapabilityChangePropagates(t *testing.T) {
 	})
 }
 
-// TestSyncPeer_PeerUpdateBumpsNetworkSerial ensures that a sync which changes
-// map-relevant peer content (agent version, hostname, capabilities, validation
-// state) advances the network serial before other peers receive the recomputed
-// map. The serial versions the distributed map, so its content must not change
-// under an unchanged serial.
-func TestSyncPeer_PeerUpdateBumpsNetworkSerial(t *testing.T) {
-	manager, _, account, _, peer2, _ := setupNetworkMapTest(t)
-
-	network, err := manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-	require.NoError(t, err)
-	serialBefore := network.CurrentSerial()
-
-	t.Run("no bump when nothing changed", func(t *testing.T) {
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            peer2.Meta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-
-		network, err := manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-		require.NoError(t, err)
-		assert.Equal(t, serialBefore, network.CurrentSerial(), "an unchanged sync should not advance the serial")
-	})
-
-	t.Run("bump when the agent version changes", func(t *testing.T) {
-		newMeta := peer2.Meta
-		newMeta.WtVersion = "0.99.99"
-
-		_, nmap, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            newMeta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-
-		network, err := manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-		require.NoError(t, err)
-		assert.Greater(t, network.CurrentSerial(), serialBefore, "a map-relevant meta change should advance the serial")
-		require.NotNil(t, nmap)
-		assert.Equal(t, network.CurrentSerial(), nmap.Network.CurrentSerial(), "the syncing peer's own map should carry the advanced serial")
-	})
-}
-
-// TestLoginPeer_PeerUpdateBumpsNetworkSerial ensures that a login which changes
-// peer state (an expired login being re-authenticated) advances the network
-// serial before other peers receive the recomputed map, and that the login
-// response itself carries the advanced serial. An unchanged login must leave
-// the serial untouched.
-func TestLoginPeer_PeerUpdateBumpsNetworkSerial(t *testing.T) {
-	manager, _, account, _, _, _ := setupNetworkMapTest(t)
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "login-serial-peer"},
-	}, false)
-	require.NoError(t, err, "unable to add the user-owned peer")
-
-	t.Run("bump when an expired login is re-authenticated", func(t *testing.T) {
-		userPeer.Status.LoginExpired = true
-		require.NoError(t, manager.Store.SavePeer(context.Background(), account.Id, userPeer))
-
-		network, err := manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-		require.NoError(t, err)
-		serialBefore := network.CurrentSerial()
-
-		_, loginNetwork, _, _, err := manager.LoginPeer(context.Background(), types.PeerLogin{
-			WireGuardPubKey: userPeer.Key,
-			UserID:          userID,
-			Meta:            userPeer.Meta,
-		})
-		require.NoError(t, err)
-
-		network, err = manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-		require.NoError(t, err)
-		assert.Greater(t, network.CurrentSerial(), serialBefore, "re-authenticating an expired login should advance the serial")
-		require.NotNil(t, loginNetwork)
-		assert.Equal(t, network.CurrentSerial(), loginNetwork.CurrentSerial(), "the login response should carry the advanced serial")
-	})
-
-	t.Run("no bump when nothing changed", func(t *testing.T) {
-		network, err := manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-		require.NoError(t, err)
-		serialBefore := network.CurrentSerial()
-
-		_, _, _, _, err = manager.LoginPeer(context.Background(), types.PeerLogin{
-			WireGuardPubKey: userPeer.Key,
-			UserID:          userID,
-			Meta:            userPeer.Meta,
-		})
-		require.NoError(t, err)
-
-		network, err = manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, account.Id)
-		require.NoError(t, err)
-		assert.Equal(t, serialBefore, network.CurrentSerial(), "an unchanged login should not advance the serial")
-	})
-}
-
 func TestUpdatePeer_DnsLabelCollisionWithFQDN(t *testing.T) {
 	manager, _, err := createManager(t)
 	require.NoError(t, err, "unable to create account manager")