Files
netbird/client/ui/services/autostart.go
Riccardo Manfrin dc89b471fa [client] checks/enforce MDM disableAutostart on every GUI launch, not just fresh installs (#6782)
## Describe your changes

`applyAutostartDefault` gated all MDM enforcement behind the one-time
`AutostartInitialized` marker, so MDM `disableAutostart` only affected
fresh installs — a policy pushed after autostart had been enabled could
not
revoke the OS login-item. 

The PR adds follow-up MDM enforcements at the top of
the function: if at any time MDM sets `disableAutostart=true` and the OS
registration is
present, force `SetEnabled(false)` to align it.

Trade-off: once the admin lifts the policy, autostart stays off until
the user re-toggles
in Settings — consistent with "MDM always wins" behavior of the other
managed keys.

## Issue ticket number and link

Follow-up to PR https://github.com/netbirdio/netbird/pull/6738
(introduced
the `disableAutostart` MDM key with fresh-install-only semantics).

## Stack

<!-- branch-stack -->

### Checklist
- [x] Is it a bug fix
- [ ] Is a typo/documentation fix
- [ ] Is a feature enhancement
- [ ] It is a refactor
- [ ] Created tests that fail without the change (if possible)

> By submitting this pull request, you confirm that you have read and
agree to the terms of the [Contributor License
Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).

## Documentation
Select exactly one:

- [x] I added/updated documentation for this change
- [ ] Documentation is **not needed** for this change (explain why)

### Docs PR URL (required if "docs added" is checked)
Paste the PR link from https://github.com/netbirdio/docs here:

<https://github.com/netbirdio/docs/pull/855>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added an administrative policy to disable client autostart (“Disable
Autostart”).
- Added support for configuring this policy via macOS MDM, Windows Group
Policy (ADMX/ADML), and registry settings.
- When enforced, the client prevents new autostart registration on fresh
installs and removes existing autostart on the next GUI launch, keeping
it disabled until the policy is lifted.

- **Bug Fixes**
- Improved enforcement logic for managed autostart defaults so policy
state is applied consistently during startup and first-run setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-07-22 11:34:13 +02:00

53 lines
1.3 KiB
Go

//go:build !android && !ios && !freebsd && !js
package services
import (
"context"
"errors"
"fmt"
"github.com/wailsapp/wails/v3/pkg/application"
)
// Autostart facade over Wails' AutostartManager. The OS autostart entry registration
// is the single source of truth; nothing is mirrored to preferences.
type Autostart struct {
mgr *application.AutostartManager
}
func NewAutostart(mgr *application.AutostartManager) *Autostart {
return &Autostart{mgr: mgr}
}
func (a *Autostart) Supported(_ context.Context) bool {
_, err := a.mgr.Status()
return !errors.Is(err, application.ErrAutostartNotSupported)
}
// IsEnabled returns false without error on unsupported platforms.
func (a *Autostart) IsEnabled(_ context.Context) (bool, error) {
enabled, err := a.mgr.IsEnabled()
if err != nil {
if errors.Is(err, application.ErrAutostartNotSupported) {
return false, nil
}
return false, fmt.Errorf("read autostart state: %w", err)
}
return enabled, nil
}
// SetEnabled takes effect on the next login, not immediately.
func (a *Autostart) SetEnabled(_ context.Context, enabled bool) error {
if enabled {
if err := a.mgr.Enable(); err != nil {
return fmt.Errorf("enable autostart: %w", err)
}
return nil
}
if err := a.mgr.Disable(); err != nil {
return fmt.Errorf("disable autostart: %w", err)
}
return nil
}