mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-28 10:31:29 +02:00
0738734b6e
A session extend must be answered from the account the peer is registered under. With a silent PKCE flow (DisablePromptLogin or max_age=0) the IdP answers from whatever session it already holds, which need not be the peer's account when several are signed in; the token then fails the user match in ExtendAuthSession with no way to pick another account. Mark the PKCE flow request as a session extend so the management server can force prompt=login for it, overriding the configured silent flow.
38 lines
1.8 KiB
Go
38 lines
1.8 KiB
Go
package client
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
|
|
"github.com/netbirdio/netbird/client/system"
|
|
"github.com/netbirdio/netbird/shared/management/domain"
|
|
"github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
// Client is the interface for the management service client.
|
|
type Client interface {
|
|
io.Closer
|
|
Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
|
|
Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error
|
|
Register(setupKey string, jwtToken string, sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
|
|
Login(sysInfo *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
|
|
// ExtendAuthSession refreshes the peer's SSO session deadline using a fresh JWT.
|
|
// Returns the new absolute deadline; zero time when the server reports the peer
|
|
// is not eligible for session extension.
|
|
ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
|
|
GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
|
|
GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
|
|
GetServerURL() string
|
|
// IsHealthy returns the current connection status without blocking.
|
|
// Used by the engine to monitor connectivity in the background.
|
|
IsHealthy() bool
|
|
// HealthCheck actively probes the management server and returns an error if unreachable.
|
|
// Used to validate connectivity before committing configuration changes.
|
|
HealthCheck() error
|
|
SyncMeta(sysInfo *system.Info) error
|
|
Logout() error
|
|
CreateExpose(ctx context.Context, req ExposeRequest) (*ExposeResponse, error)
|
|
RenewExpose(ctx context.Context, domain string) error
|
|
StopExpose(ctx context.Context, domain string) error
|
|
}
|