netbird

mirror of https://github.com/netbirdio/netbird.git synced 2026-07-28 17:02:36 -04:00

Files

Maycon Santos bab5572a74 [management, proxy] scope agent-network model allowlist per policy/group and provider (#6905 )

## Describe your changes

The model-allowlist guardrail was merged into one account-wide union and
enforced flat on every request, ignoring which policy/group/provider
authorised it. With multiple policies — especially a mix of guardrailed
and un-guardrailed ones — this caused:

- **false-allow**: a model allowlisted for one group/provider leaked to
any caller; and
- **false-deny**: an un-guardrailed policy (intended unrestricted) was
blocked by another policy's allowlist.

Enforcement is now policy/group-aware, mirroring `llm_limit_check`:

- **Management (`SelectPolicyForRequest`) is authoritative.** It uses
the request model (already carried in
`CheckLLMPolicyLimitsRequest.model`, previously ignored) to keep only
applicable policies whose guardrails permit the model; no
allowlist-enabled guardrail = unrestricted. Denies
`llm_policy.model_blocked` when policies govern the (provider, groups)
but none permits the model.
- **Proxy `llm_guardrail` becomes a per-provider fail-closed backstop.**
The synthesiser emits an allowlist only for providers every authorising
policy restricts; the middleware keys off the resolved provider id and
keeps unknown-model fail-closed.

2026-07-27 20:43:59 +02:00

auth.gohtml

[management, reverse proxy] Add reverse proxy feature (#5291 )

2026-02-13 19:37:43 +01:00

header.go

[proxy, management] Add header auth, access restrictions, and session idle timeout (#5587 )

2026-03-16 15:22:00 +01:00

identity.go

[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226 )

2026-05-25 17:41:50 +02:00

middleware_test.go

[management,proxy,client] 0.74.0 version (#6563 )