mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-25 00:51:28 +02:00
58d0793870
Reverse resolution -- hostname to owning account -- prefiltered candidates by "strip the first label and treat the rest as a cluster address". For an endpoint whose parent is a DNS zone that matches no cluster, the prefilter found nothing and resolution failed for every zone-based tenant. Both endpoint shapes put the account's label in the first DNS label, and the label is now globally unique, so one indexed point lookup resolves either shape. This replaces the prefilter outright rather than adding a fallback scan, which matters because the lookup runs per request from the authentication path. A label match is not sufficient on its own -- owning "brave-otter" does not mean owning "brave-otter.example.com" -- so the resolved row's endpoint is still compared against the requested hostname. Only a not-found is translated to "no such endpoint"; a genuine store failure surfaces, so a database outage cannot be mistaken for a miss.