Correct the profile removal and SSH authentication privilege wording - #895
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughChangesSocket documentation
SSH and CLI documentation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/client/desktop-app.mdx`:
- Around line 79-91: The desktop-app privilege note currently implies that MDM
can configure all three SSH-related switches. Narrow the MDM fallback sentence
to the Enable SSH Server setting only, or explicitly document separate MDM
policies for Enable Root Login and SSH authentication; keep the existing
privilege and safe-state behavior unchanged.
In `@src/pages/client/grpc-socket.mdx`:
- Around line 116-119: Update the introductory authorization statement in the
socket documentation to scope the “any local user” claim to sockets accessible
to local users, or specifically to the default Unix socket. Preserve the
existing platform-specific credential and refusal behavior described in the
following sentences.
In `@src/pages/get-started/cli.mdx`:
- Line 836: Update both `--upload-bundle-insecure` flag descriptions in the CLI
documentation to replace “requires root” with platform-neutral wording: require
root on Linux/macOS or an administrator on Windows, matching the existing
wording in the troubleshooting documentation.
- Around line 512-514: Add Windows-specific elevated PowerShell or Command
Prompt variants for the privilege-required NetBird commands near the SSH
examples, including the occurrences at the referenced additional sections.
Alternatively, explicitly label the existing sudo commands as Linux/macOS-only,
while ensuring Windows users have an administrator-elevated equivalent.
- Line 523: Update the CLI troubleshooting guidance around the
`--disable-ssh-auth` command to warn that it expands SSH access to any peer with
network access and should only be used temporarily. Add the corresponding
command to re-enable SSH authentication afterward, while preserving the existing
disable-authentication command.
In `@src/pages/help/troubleshooting-client.mdx`:
- Around line 311-314: Update the Note describing --upload-bundle-insecure to
explicitly state that it bypasses TLS certificate verification and may expose
diagnostic data in transit. Add a brief recommendation to use it only with a
trusted private endpoint or network and to enable --anonymize when appropriate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f6cd1712-bfa4-4903-b2cb-c8dadd530305
📒 Files selected for processing (7)
src/pages/client/desktop-app.mdxsrc/pages/client/grpc-socket.mdxsrc/pages/client/json-socket.mdxsrc/pages/get-started/cli.mdxsrc/pages/help/troubleshooting-client.mdxsrc/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdxsrc/pages/manage/peers/ssh.mdx
2828f5f to
bdf3c4a
Compare
2 participants
Follow-up to #894. Corrects three statements that do not match the client code on main (
0f5d2d91f).RemoveProfiletreats deregistration as best-effort, so an unprivileged caller removes the profile locally and the peer stays registered on the management servernetbird downto the port-forwarding examples, sinceupreturns early on a connected client without applying the flagsSummary by CodeRabbit