From 9c8e003d723f457b483397477e46402cffc22c5a Mon Sep 17 00:00:00 2001 From: TechHutTV Date: Fri, 22 May 2026 12:08:15 -0700 Subject: [PATCH] remove login flow --- .../plugins/netbird/Netbird-1-Settings.page | 13 ++++++++- .../emhttp/plugins/netbird/include/action.php | 27 ++++++++++++++++--- .../emhttp/plugins/netbird/scripts/apply.sh | 2 ++ 3 files changed, 38 insertions(+), 4 deletions(-) diff --git a/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page b/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page index 7a24b6b..f2f16cc 100644 --- a/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page +++ b/src/usr/local/emhttp/plugins/netbird/Netbird-1-Settings.page @@ -104,7 +104,7 @@ _(Setup Key)_: :
-Pre-authentication setup key generated in your NetBird dashboard. Optional — if blank, the Status tab will show an interactive login URL after you click Connect. +Pre-authentication setup key from your NetBird dashboard. Required the first time you register a profile, and after changing the management URL or hostname (which re-registers the peer). Reconnecting an already-registered profile does not need it. This plugin always registers with a setup key; interactive SSO login is not used.
_(Hostname)_: @@ -180,6 +180,17 @@ function nbViewProfile(name) { function nbSaveSettings() { var profile = $('#nb-edit-profile').val(); var form = document.getElementById('nb-settings-form'); + // A setup key is required only when registering: a profile that has no key + // stored yet (initial setup). Reconnecting an already-registered profile + // doesn't need one. (A management-URL/hostname change also re-registers; the + // server enforces that case and returns a clear error if the key is missing.) + var nbRequireKey = ; + if (nbRequireKey && !($('input[name=SETUP_KEY]', form).val() || '').trim()) { + swal({ title: 'Setup key required', + text: 'Enter a setup key from your NetBird dashboard to register this profile. Interactive SSO login is not supported.', + type: 'warning' }); + return; + } var data = { action: 'save', name: profile, diff --git a/src/usr/local/emhttp/plugins/netbird/include/action.php b/src/usr/local/emhttp/plugins/netbird/include/action.php index 2bf1269..c7d3317 100644 --- a/src/usr/local/emhttp/plugins/netbird/include/action.php +++ b/src/usr/local/emhttp/plugins/netbird/include/action.php @@ -3,7 +3,9 @@ * AJAX endpoint for the Status and Settings pages. * * Actions: - * up — netbird up (uses cfg credentials if set) + * up — netbird up using the active profile's stored credentials + * (reconnects via stored identity; registration via setup + * key happens on save, interactive SSO is never used) * down — netbird down * restart — restart the rc.d daemon * profile-list — return list of profiles as JSON (rarely needed; pages embed) @@ -108,7 +110,9 @@ switch ($action) { Netbird\nb(['profile', 'select', $active]); } $creds = $active !== '' ? Netbird\readProfileCfg($active) : []; - // Bounded so a failing login's retry/backoff can't hang the request. + // Reconnect uses the profile's stored identity; no setup key needed here + // (a key is only required to register, which happens on save). Bounded so + // a failing reconnect's retry/backoff can't hang the request. [$rc, $out] = Netbird\nb(nb_up_args($creds), 90); Netbird\nbUnlock($lock); echo json_encode([ @@ -212,7 +216,7 @@ switch ($action) { } // Re-run `up` using THIS profile's own stored credentials, so switching // never connects with another profile's settings. Bounded so a failing - // login can't hang the request. + // reconnect can't hang the request. [$rcUp, $outUp] = Netbird\nb(nb_up_args(Netbird\readProfileCfg($name)), 90); Netbird\nbUnlock($lock); echo json_encode([ @@ -266,6 +270,23 @@ switch ($action) { $pskChanged = trim($creds['PRESHARED_KEY']) !== '' && trim($old['PRESHARED_KEY']) !== trim($creds['PRESHARED_KEY']); $mode = ($mgmtChanged || $hostChanged) ? 'reregister' : ($pskChanged ? 'reconnect' : 'ensure'); + // A setup key is required only when the peer is (re)registering — initial + // setup (no key was ever stored for this profile) or a re-register + // triggered by a management URL / hostname change. Reconnecting an + // already-registered profile reuses its stored identity and needs no key, + // and we never fall back to interactive SSO. + $everConfigured = trim($old['SETUP_KEY']) !== ''; + $registering = !$everConfigured || $mode === 'reregister'; + if ($registering && trim($creds['SETUP_KEY']) === '') { + http_response_code(400); + echo json_encode([ + 'type' => 'error', + 'title' => 'Setup key required', + 'message' => 'A setup key is required to register this profile. Generate one in your NetBird dashboard and paste it here.', + ]); + break; + } + if (!Netbird\writeProfileCfg($name, $creds)) { http_response_code(500); echo json_encode(['type' => 'error', 'message' => "Could not write profile '$name'."]); diff --git a/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh b/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh index a298913..e732c8d 100755 --- a/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh +++ b/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh @@ -70,6 +70,8 @@ if [ "$ENABLE_NETBIRD" = "0" ] || [ "$ENABLE_NETBIRD" = "false" ]; then fi # Per-profile credentials (override any legacy values sourced from the global cfg). +# A setup key is only needed to register (enforced by action.php's save on initial +# setup / re-register); reconnects reuse the stored identity, so no key guard here. MANAGEMENT_URL="" ; SETUP_KEY="" ; HOSTNAME="" ; PRESHARED_KEY="" if [ -f "$PROFILE_CFG" ]; then # shellcheck disable=SC1090