[client] Fix session extension and SSH auth always using the device code flow on Linux

[lixmal]

Describe your changes

netbird login --extend and SSH authentication always pick the device code flow on Linux, because the daemon decides which flow to use by reading its own environment. A service never inherits the user's session variables, so it always concludes there is no graphical session, and the login fails on servers where the device code flow is not available.

• Let the caller answer whether a graphical session is available: the CLI and the SSH proxy report what they see, the desktop UI reports one outright, and session extension and SSH authentication use that instead of the daemon environment
• Detect a graphical session from the variables that decide whether a browser can actually be opened: DISPLAY and WAYLAND_DISPLAY (the same pair xdg-open checks), BROWSER, and the session type reported by logind, in addition to the desktop variables checked before

Issue ticket number and link

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• I ran and tested this change locally — I did not rely on CI to find out whether it works
• This PR has a single purpose (not a fix + refactor + feature in one)
• This change is a trivial fix, OR it links an issue the NetBird team agreed on beforehand. Changes to the public API, gRPC protocols, functionality behavior, CLI / service flags, or new features always need that agreement first. See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Flow selection is internal to the client; no configuration or user-facing option changes.

Summary by CodeRabbit

• New Features

  • Improved authentication flow selection based on whether a graphical session is available.
  • Added graphical-session detection across supported desktop environments.
  • Authentication requests now carry session context to support the appropriate login experience.

• Bug Fixes

  • Improved login, OAuth, and session-extension behavior when the daemon and user interface run in different environments.

• Tests

  • Added coverage for graphical-session detection across supported platforms and session configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f01f8f16-5cb7-4c6f-9a55-b9ec44378d9b

📥 Commits

Reviewing files that changed from the base of the PR and between 58c09ea and f27a093.

⛔ Files ignored due to path filters (1)

• client/proto/daemon.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (9)

• client/cmd/login.go
• client/cmd/up.go
• client/proto/daemon.proto
• client/server/server.go
• client/ssh/common.go
• client/ui/authsession/service.go
• client/ui/services/connection.go
• util/common.go
• util/session_test.go

---

📝 Walkthrough

Walkthrough

The change centralizes graphical-session detection in util.HasGraphicalSession(). Authentication callers include this state in daemon requests, and server OAuth flows use the caller-provided value.

Changes

Graphical Session Authentication

Layer / File(s)	Summary
Centralized graphical-session detection util/common.go, util/session_test.go	Adds util.HasGraphicalSession() with platform and environment checks. Adds coverage for graphical, non-graphical, and unsupported session types.
Authentication request propagation client/proto/daemon.proto, client/cmd/login.go, client/cmd/up.go, client/ssh/common.go, client/ui/authsession/service.go, client/ui/services/connection.go	Adds hasGraphicalSession to JWT and extension requests. CLI, SSH, and UI callers populate graphical-session state.
Daemon OAuth flow selection client/server/server.go	Passes request-provided graphical-session state to auth.NewOAuthFlow and removes daemon-side desktop detection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant SSH
  participant UI
  participant Daemon
  participant OAuthFlow
  CLI->>Daemon: Send JWT request with HasGraphicalSession
  SSH->>Daemon: Send JWT request with HasGraphicalSession
  UI->>Daemon: Send extension request with HasGraphicalSession
  Daemon->>OAuthFlow: Create flow with caller-provided session state

Loading

Possibly related PRs

• netbirdio/netbird#7186: Shares the graphical-session detection and propagation changes across authentication flows.
• netbirdio/netbird#6885: Modifies the same authentication flow files for device-code authentication controls.

Suggested reviewers: bison

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the behavior change and testing, but the required issue ticket link is missing.	Add the agreed issue ticket or discussion link because this PR changes authentication behavior and the gRPC protocol.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the Linux session extension and SSH authentication fix.
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oauth-graphical-session

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
5.8% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Release artifacts

Built for PR head f27a093 in workflow run #17756.

Artifact	Link
All release artifacts	Download
Linux packages	Download
Windows packages	Download
macOS packages	Download
UI artifacts	Download
UI GTK3 artifacts	Download
UI macOS artifacts	Download

GHCR images (amd64)

• ghcr.io/netbirdio/management:pr-7187
• ghcr.io/netbirdio/netbird-server:pr-7187
• ghcr.io/netbirdio/netbird:pr-7187
• ghcr.io/netbirdio/relay:pr-7187
• ghcr.io/netbirdio/reverse-proxy:pr-7187
• ghcr.io/netbirdio/signal:pr-7187
• ghcr.io/netbirdio/upload:pr-7187

This comment is updated by the Release workflow. Artifact links expire according to the workflow retention policy.