mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-26 17:41:30 +02:00
27b2d3f351
At proxy connect time, the declared cluster address is validated for shape and checked for availability (`IsClusterAddressAvailable`), and from then on the declaration is what routes the cluster's mappings to the connection. Deployments that embed management through the integrations seam may need a policy on that claim — deciding which credential is allowed to declare which address. This adds an optional `ProxyConnectAuthorizer` hook on `ProxyServiceServer`, following the pattern of the existing `Set*` seams (`SetServiceManager`, `SetAgentNetworkSynthesizer`, `SetAgentNetworkLimitsService`, `SetProxyController`): - A nil-able interface field plus `SetProxyConnectAuthorizer`, guarded by the existing mutex. - One call at the end of `validateProxyConnect`, so both `GetMappingUpdate` and `SyncMappings` are covered by a single site. - **Nothing installs it by default** — with the hook unset (always, in this repo), behavior is byte-for-byte unchanged, which the tests pin. Design details: - The authorizer runs **last** — after input validation and the availability check — and **outside** the account-scoped branch, so management-wide tokens and token-less connects are also presented to it rather than bypassing policy. - The authorizer receives the presented `*types.ProxyAccessToken` (nil when none), the proxy ID, and the declared address. Everything it needs is already in the request/context; no proto or schema change. - A plain error from the authorizer surfaces as `PermissionDenied`, keeping an authorization rejection distinguishable from the `AlreadyExists` used for address conflicts in proxy logs. A status error passes through unchanged so implementations can pick their own code.