* Replace the pending-approval error page with a dedicated screen
A user waiting for an administrator to approve their account was shown
the generic /error page: an error icon, a raw response_message dump and
"if you believe this is an error, please contact your administrator".
Waiting for approval is an expected part of signing up, so it now gets a
screen of its own, following the onboarding layout of logo, centered card
and a stepper placing the user between "Account Created" and
"Join Account".
The owner to contact is read out of the refusal management sends, which
names a masked address, and the copy asks for the owner without naming
one when the address is absent.
Steps.Step gains an optional status and size, so a step can render as
complete, current or upcoming at a larger scale. Steps that pass neither
keep the look used by the instruction-list steppers.
* Detect the pending-approval screen by test id in e2e
The three places that recognise a pending user matched on "User Approval
Pending", the heading the old error page rendered. The screen that
replaced it has no heading, so the approval branch of the login races
could never resolve and every leg timed out instead: both fixtures treat
approval as a legitimate outcome, not a failure.
They now key off the data-testid on the screen's root, which does not
move when the copy does.
* Point the pending-approval footer at the docs and support pages
A mailbox asks the reader to compose something; the approval docs explain
what they are waiting for, and the support page routes them the way every
other NetBird surface does. The support address constant went with it.
* Render the pending-approval screen from the caller-identity response
Every call a pending user makes is refused, but only /users/current
names the owner who can approve them. Redirecting to /error on whichever
403 landed first therefore threw that name away about as often as it
kept it, and which screen appeared came down to a race.
Pending users are no longer routed to /error at all. The provider that
already waits on /users/current renders the screen from that response,
which also ends the wait it could never finish: the caller identity it
blocks on is exactly what such a user is refused.
* Decide the refused-user screen from the responses, not the first 403
Routing on whichever refused call landed first meant the screen depended
on a race, and once only /users/current could name the owner it meant
the name was usually thrown away. Management older than that reports a
pending user as merely blocked there, so it also meant a pending user
landed on the blocked screen, which is what the e2e run caught.
UserProfileProvider now decides from the responses it already waits on:
/users/current first, since it alone names the owner, then the user list,
which reports pending on every management version. Blocked keeps the
error page, decided after pending so the older wording cannot win.
* Wait for both refusal responses before choosing a screen
Concluding blocked the moment /users/current said so meant concluding it
while the user list was still in flight — and on management that reports
a pending user as merely blocked there, that list is the one response
that would have said otherwise. The screen it was meant to prevent was
reachable again, just through a narrower window.
The decision moves into resolveRefusedUser, which holds off while a
better-informed response is still coming: the named one before the list,
the list before blocked. Navigating to the error page becomes an effect
rather than a call made while rendering.
* Move the refused-user decision next to the provider that makes it
It sat in utils only because two callers needed it, but the second one —
the guard keeping these errors off the error boundary — needs nothing
more than to recognise them, which is a line of its own. So the decision
moves beside the provider that acts on it, and reads an error into a
RefusalReason rather than assembling a discriminated union.
The cost is that both files now spell out management's wording. The one
here is the tested reading; the one in @utils/api only has to be no
narrower than it.
* Assert the refusal kind the resolver actually returns
The result property is kind, not reason. toEqual types its argument
loosely, so the stale expectations type-checked and only failed when run.
Bump next from 16.3.0 to 16.3.4 and refresh the transitive lockfile
entries that came with it (@next/* swc binaries, sharp 0.35.4,
rolldown, vitest, playwright).
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove the unreachable FirewallGPT module and the abandoned traffic-event
detail prototypes, along with the dependencies they were the sole consumers of.
FirewallGPT was disabled in 9d8d9ee4 by removing its trigger button, leaving
the modal mounted but impossible to open. TrafficEventDetails was never
imported anywhere, and it was the only consumer of TrafficEventChart.
Dependency changes:
- Drop @faker-js/faker, whose only usage was mock chart data in the removed
TrafficEventChart. This also resolves GHSA-qxc2-j82w-r537 without needing
the 9 -> 10 major upgrade.
- Drop react-confetti-explosion, only used by the removed
FirewallGPTSuccessModal.
- Bump @types/node to 20.19.43 so it satisfies the peer range of the vite
version pulled in by vitest, silencing an ERESOLVE warning on install.
Stays on the 20.x line to match the Node 20 used in CI.
- Add an allowScripts deny policy for the four packages with install scripts.
Both @axa-fr postinstalls are bare echo statements, fsevents ships a
prebuilt binary, and the unrs-resolver postinstall only verifies a binding
that optionalDependencies already installs.
The peer view matched policies only by source group membership, so a
policy whose source is the peer itself never appeared in that peer's
view. There was no group fallback either: a rule carrying a
sourceResource has its sources nulled on save, so the group check could
only ever return false for exactly these policies.
Such policies are reachable from the canvas itself, since dragging a
connection off a peer node writes a sourceResource rather than a group.
A user could create a peer-sourced policy, deploy it, drill into that
same peer and not see it.
Match rule.sourceResource against the peer id alongside the group check.
The rendering side needs no change, as select-peer-node is the peer and
its edge to the policy is drawn unconditionally. Draft mode is fixed
transitively: useDraft harvests visible policies from the live view's
nodes, and already draws a sourceResource peer as a source card.
Alpine 3.14 reached end of life in May 2023 and has received no security
fixes for roughly three years. nginx is installed from the Alpine repos
rather than pinned, so the base bump also moves nginx 1.20.2 -> 1.30.4,
certbot 1.16.0 -> 5.6.0 and supervisor 4.2.2 -> 4.3.0.
Alpine 3.24 carries security support until June 2028.
Verified by building and running this Dockerfile on 3.14, 3.23 and 3.24 and
comparing: the served index.html is byte-identical across all three, the CSP
response header hashes identically, `nginx -t` passes on the existing config,
and supervisord reaches the same state. /etc/crontabs/root and
/etc/nginx/http.d/ still exist on 3.24, so the `rm /etc/crontabs/root` step and
the config COPY paths are unaffected. Every certbot flag used by init_cert.sh
is still accepted by certbot 5.x.
Certificate issuance itself could not be exercised without a real domain, so
the certbot 1.x -> 5.x jump should get one staging issuance before rollout.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade to Next.js 16.3
Turbopack is now the default for both `next dev` and `next build`, so the
separate `turbo` script is redundant and has been dropped.
`next build` rewrites tsconfig `moduleResolution` to "bundler", which Next 16
expects.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: migrate ESLint to flat config
`next lint` was removed in Next 16, so `npm run lint` had been failing with
"Invalid project directory provided, no such directory: ./lint" since that
upgrade. eslint-config-next 16 also ships flat config only, which the old
.eslintrc.json could not consume.
Ignores .claude/ so stray worktree copies of the repo are not linted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: replace ip-cidr with ip-address to clear CVE advisories
ip-cidr pulled a vulnerable ip-address (GHSA-mwp4-54f8-5fhr, high: leading-zero
octets decoded as decimal while resolvers read them as octal, enabling SSRF;
GHSA-v2v4-37r5-5v8g, moderate: XSS in Address6 HTML methods). npm reported "no
fix available" because even the latest ip-cidr pins ip-address ^9.0.5, still
inside the vulnerable range.
ip-address 10.x was already a direct dependency and covers every use: its
isValid rejects leading-zero octets and validates mask ranges natively, and
isInSubnet replaces the one `new cidr().contains()` call site.
The new validators were differential-tested against the real ip-cidr over a
67-input corpus (134 checks) before removal, with no divergences; containment
was checked across 14 v4/v6/boundary/cross-family cases. `npm audit` now
reports 0 vulnerabilities.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: replace next-themes with an in-repo ThemeProvider
next-themes renders an inline <script> to set the theme before paint. It was
loaded through dynamic(ssr: false), so that script rendered on the client, where
React 19 never executes script tags and warns:
Encountered a script tag while rendering React component.
Upgrading would not have helped; 0.4.6 still renders the script
unconditionally. The script was also useless here: injected after hydration, it
could not prevent a flash, and postbuild.js hoists inline scripts out of the
export anyway.
The replacement keeps the same `netbird-theme` storage key and three-mode
support, and sets the theme class on <html> in the layout instead, so the
static export ships the correct theme in its first byte with no script at all.
Dropping the dynamic(ssr: false) wrapper removed an implicit prerender bailout
for the whole provider tree, which exposed isNetBirdCloud() reading
window.location during the build-time render; it is now guarded. The exported
HTML is byte-identical either way, since the page already bails to client
rendering.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: key the router children slot in the dashboard layout
React logged "Each child in a list should have a unique key prop. Check the
render method of DashboardPageContent." The App Router's segment element for
`children` arrives with a null key, which React flags once it is reconciled
alongside the Navigation sibling. Wrapping it in a keyed Fragment resolves it.
Verified in the browser both ways: with the Fragment the console is clean,
without it the warning returns.
Also applies the pending simple-import-sort fix for this file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: match IPv4-mapped IPv6 hosts against IPv4 CIDRs
Regression from replacing ip-cidr. Its contains() normalised an IPv4-mapped
IPv6 address to the embedded v4 before the subnet check, so
contains("::ffff:10.0.0.5") on 10.0.0.0/24 returned true; isHostInCIDR returned
false. Verified against ip-cidr@3.1.0 directly.
This is reachable: isValidIP accepts "::ffff:10.0.0.5", so a mapped host entered
in ReverseProxyAddressInput against an IPv4 resource CIDR was wrongly rejected.
An IPv6 network still rejects a mapped host, so families do not leak. Checked
across 20 cases (6 mapped-host, 14 pre-existing), with the mapped expectations
taken from measured ip-cidr output.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive skeleton colors from the resolved theme
SkeletonTheme had the dark palette hardcoded, so a light theme would render
dark skeletons. The light values are the ones already defined on the
feature-light-theme branch rather than new invented colors.
resolvedTheme is tracked in state and updated from the existing apply(), so the
palette also follows the OS preference under "system".
Latent today, since DarkModeToggle disables both Light and System.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: center icons in collapsed navigation rail
Nav items have 24px of left padding (px-3 on the li plus px-3 on the
button), so with 16px icons the icon center lands at 32px. The 70px rail
centered at 35px, leaving icons 3px off. Narrow the rail to 64px so the
two line up, and match the content offset in PageContainer.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use one plus icon across network tab Add buttons
The Resources and Routing Peers Add buttons used tabler's IconCirclePlus
while the Services tab used lucide's PlusCircle. Both were size 16, but
the two icon sets draw at different inner scales, so the glyphs read as
different sizes. Standardize on lucide.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
When creating a network resource and adding a policy with a single peer
(sourceResource) as the source, the payload included both an empty
`sources: []` array and `sourceResource`, causing the backend to reject
it with "specify either sources or source resources not both".
`createPolicyForResource` always computed `sources` as an array while the
`...rule` spread carried `sourceResource` through. This mirrors the
existing destinations handling: gate `sources` on `rule.sourceResource`
so it becomes undefined (and is dropped during serialization) when a
source resource is set.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add acl tooltips
* Adjust resource modal and add tooltips
* Prevent nextjs navigation trigger on tab change
* Update wording
* add acl into resource
* Refactor resource policies
* Add prop to hide group edit and disable redirect
* Add skeleton loader to network page
* Create policy for new resources
* Show existing policies if groups are matching
* Add confirm dialog after creating resource without policy
* Add dialog if user edits policy that is used in multiple resources
* Add callout when selecting resource groups containing policies
* Add dialog if deleting policies containing resources
* Fix stale policies and new group creation in resource modal
* Remove whitespace
* Fix sort
* Cleanup
* Address coderabbit comments
* Fix policy alignment
* Fix initial resource
* disable selector if user did not select resource groups
* Consider current resource when editing / deleting policy
* Remove unused mutate
* Fix dot position
* Remove ask for policy
* Fix policy index
* Fix multiple resource confirm dialog on policy cell
* Redirect /setup to /peers if not setup is required
* Fix bad state while redirect
* Prevent redirect to /setup if already on /setup
* Fix loading state
* move our group membership from the settings menu, into the Team menu
* add action to the table and new group page
* update group page and return group settings to settings menu
* new update
* fix bug
* group action: add peer to group
* group action: add user to group
* Update wording, redirect to group page after creation
* Add better table loading skeleton
* Adjust group name cell
* Update wording
* Update sort order
* Refactor
* Merge main
* Fix button height
* Fix resources table
* Adjust table loading skeleton
* Adjust table loading skeleton
* Add loading to tab triggers
* Update meta
* Update group location
* Fix rename
* Refactor group details
* Fix linked peers
* Fix group usage
* Fix incrementing peer count
* Prevent renaming to already existing group
* Fix group name click
* Update group nav
* Make group table cells clickable
* Fix breadcrumbs
* Update wording
* Add confirmation before removing users from group
* Add permissions
* Add initial group for network routes
* Add acl and routing peer groups
---------
Co-authored-by: aliamerj <aliamer19ali@gmail.com>
implements a "Sync with cloud" functionality that includes various UI improvements, code refactoring, and component extractions. The changes focus on enhancing the user interface, improving code organization, and adding new features for remote access and activity tracking.
- Refactors inline components into reusable shared components
- Adds new activity tracking for group operations
- Updates remote access configuration and UI components
- Enhances styling and layout for better user experience
* Add resource description, add single resource for acl, add icons for group badges, add inactivity expiration
* Add extra dns labels, remove routing restriction
* Fix wrong ui state for routing peer modal in networks
* Add confirmation dialog when blocking users
* Keep peer sort order when switching pages
* Update sidebar navigation order and remove deprecation notice
* Fix issue when hovering over truncated text in a group badge closes the multiple groups popover
* Update group text in network resource modal
* Update networks page text
* Fix line height
* Add search to resource table
* Switch networks flow to create first resources and then add routers
* Add enabled toggle to routing peers
* Add enabled toggle to network resources
* Add resource group modal and adjust tables
* Clarify networks
* Fix not properly aligned horizontal scroll bar
* Add option to install netbird after creating a setup key
* Fix text for install netbird modal
* Show resources count in group settings
* Fix "no results" and "no routing peers" text showing at the same time
* Fix wording
* Fix resource policy count
* Hide resource count when selection source groups
* Extend networks routing peer modal with option to create a setup key and install netbird
* Add option for horizontal stepper
* Generate setup key when installing netbird from routing peer modal
* Add confirm dialog to let the user know a one-off setup-key will be created. This avoids accidental clicking and later confusion on the setup keys page
---------
Co-authored-by: Misha Bragin <bangvalo@gmail.com>
* Update axa oidc library and package.json
* Update ACL port state to show correct value
* Filter user groups by unique groups only
* Add peer multiselect, optimize dropdown performance for peer selection, remove 'all' group from some dropdowns, various ui / ux optimizations
* Add peer multiselect, optimize dropdown performance for peer selection, remove 'all' group from some dropdowns, various ui / ux optimizations
* Add try catch block for global search
* Add fallback for group name
* Add fallback for setup key name
* Do not load setup key modal if it's not open
* Check if auto_groups actually exists for the setup keys
* Add fallback for group names in setup keys table
* Add fallback for group names in peers table
* Change icon size
* Remove integrations
* Add no cache header
* Add analytics event tracking
* Add small announcement improvements
* Remove peer approval setting
* Do not load countries when user has no permission
* Add tab query params to settings
* Decrease navigation font size
* Change order of providers
* Increase padding for modals
* Show page only when user is fully loaded and found
* Remove unused state
* Remove integrations page
Eduard Gert
