remove login flow

src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page

@@ -104,7 +104,7 @@ _(Setup Key)_:
 : <input type="password" name="SETUP_KEY" value="<?=htmlspecialchars($setupKey)?>" autocomplete="off">
 
 <blockquote class="inline_help">
-Pre-authentication setup key generated in your NetBird dashboard. Optional — if blank, the Status tab will show an interactive login URL after you click <b>Connect</b>.
+Pre-authentication setup key from your NetBird dashboard. Required the first time you register a profile, and after changing the management URL or hostname (which re-registers the peer). Reconnecting an already-registered profile does not need it. This plugin always registers with a setup key; interactive SSO login is not used.
 </blockquote>
 
 _(Hostname)_:
@@ -180,6 +180,17 @@ function nbViewProfile(name) {
 function nbSaveSettings() {
     var profile = $('#nb-edit-profile').val();
     var form = document.getElementById('nb-settings-form');
+    // A setup key is required only when registering: a profile that has no key
+    // stored yet (initial setup). Reconnecting an already-registered profile
+    // doesn't need one. (A management-URL/hostname change also re-registers; the
+    // server enforces that case and returns a clear error if the key is missing.)
+    var nbRequireKey = <?= empty($setupKey) ? 'true' : 'false' ?>;
+    if (nbRequireKey && !($('input[name=SETUP_KEY]', form).val() || '').trim()) {
+        swal({ title: 'Setup key required',
+               text: 'Enter a setup key from your NetBird dashboard to register this profile. Interactive SSO login is not supported.',
+               type: 'warning' });
+        return;
+    }
     var data = {
         action:         'save',
         name:           profile,

src/usr/local/emhttp/plugins/netbird/include/action.php

@@ -3,7 +3,9 @@
  * AJAX endpoint for the Status and Settings pages.
  *
  * Actions:
- *   up              — netbird up (uses cfg credentials if set)
+ *   up              — netbird up using the active profile's stored credentials
+ *                     (reconnects via stored identity; registration via setup
+ *                     key happens on save, interactive SSO is never used)
  *   down            — netbird down
  *   restart         — restart the rc.d daemon
  *   profile-list    — return list of profiles as JSON (rarely needed; pages embed)
@@ -108,7 +110,9 @@ switch ($action) {
             Netbird\nb(['profile', 'select', $active]);
         }
         $creds = $active !== '' ? Netbird\readProfileCfg($active) : [];
-        // Bounded so a failing login's retry/backoff can't hang the request.
+        // Reconnect uses the profile's stored identity; no setup key needed here
+        // (a key is only required to register, which happens on save). Bounded so
+        // a failing reconnect's retry/backoff can't hang the request.
         [$rc, $out] = Netbird\nb(nb_up_args($creds), 90);
         Netbird\nbUnlock($lock);
         echo json_encode([
@@ -212,7 +216,7 @@ switch ($action) {
         }
         // Re-run `up` using THIS profile's own stored credentials, so switching
         // never connects with another profile's settings. Bounded so a failing
-        // login can't hang the request.
+        // reconnect can't hang the request.
         [$rcUp, $outUp] = Netbird\nb(nb_up_args(Netbird\readProfileCfg($name)), 90);
         Netbird\nbUnlock($lock);
         echo json_encode([
@@ -266,6 +270,23 @@ switch ($action) {
         $pskChanged  = trim($creds['PRESHARED_KEY']) !== '' && trim($old['PRESHARED_KEY']) !== trim($creds['PRESHARED_KEY']);
         $mode = ($mgmtChanged || $hostChanged) ? 'reregister' : ($pskChanged ? 'reconnect' : 'ensure');
 
+        // A setup key is required only when the peer is (re)registering — initial
+        // setup (no key was ever stored for this profile) or a re-register
+        // triggered by a management URL / hostname change. Reconnecting an
+        // already-registered profile reuses its stored identity and needs no key,
+        // and we never fall back to interactive SSO.
+        $everConfigured = trim($old['SETUP_KEY']) !== '';
+        $registering    = !$everConfigured || $mode === 'reregister';
+        if ($registering && trim($creds['SETUP_KEY']) === '') {
+            http_response_code(400);
+            echo json_encode([
+                'type'    => 'error',
+                'title'   => 'Setup key required',
+                'message' => 'A setup key is required to register this profile. Generate one in your NetBird dashboard and paste it here.',
+            ]);
+            break;
+        }
+
         if (!Netbird\writeProfileCfg($name, $creds)) {
             http_response_code(500);
             echo json_encode(['type' => 'error', 'message' => "Could not write profile '$name'."]);

src/usr/local/emhttp/plugins/netbird/scripts/apply.sh

@@ -70,6 +70,8 @@ if [ "$ENABLE_NETBIRD" = "0" ] || [ "$ENABLE_NETBIRD" = "false" ]; then
 fi
 
 # Per-profile credentials (override any legacy values sourced from the global cfg).
+# A setup key is only needed to register (enforced by action.php's save on initial
+# setup / re-register); reconnects reuse the stored identity, so no key guard here.
 MANAGEMENT_URL="" ; SETUP_KEY="" ; HOSTNAME="" ; PRESHARED_KEY=""
 if [ -f "$PROFILE_CFG" ]; then
     # shellcheck disable=SC1090