policy,state: authorize reauth tags against the authenticating user

Re-authenticating an already-tagged node with --advertise-tags was always
rejected: tag authorization asked whether the NODE may hold the tag, but a
tag-owned node has no user and its IP is in no owner set, so every tag was
refused and --force-reauth left the node logged out.

Authorize each requested tag against the authenticating user as well, via
a new PolicyManager.UserCanHaveTag. Both reauth check sites are fixed -
the pre-check in applyAuthNodeUpdate and the apply-time re-check in
processReauthTags whose rejection was discarded - so a permitted tag is
actually applied, not silently dropped. Tags the user does not own are
still rejected.

Also clear the auth-key reference when a reauth untags a node: a node
created by a tagged ephemeral key would otherwise stay ephemeral after
converting to user-owned and be garbage-collected on disconnect. The
cleared reference is persisted (writing NULL is FK-safe).

Fixes #3374

Author: kradalby

CHANGELOG.md

@@ -46,6 +46,7 @@ keys remain all-access.
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
 - A tagged node can re-authenticate after `tailscale logout` again: logout no longer stamps a key expiry on a tagged node, and a stale expiry left by an older version is cleared on re-registration [#3371](https://github.com/juanfont/headscale/issues/3371)
 - Re-registering a tagged node with a different pre-auth key now applies the new key's tags instead of silently keeping the old ones, and persists the new key reference so a node's ephemeral status no longer reverts on restart [#3370](https://github.com/juanfont/headscale/issues/3370)
+- An already-tagged node can re-authenticate with `--advertise-tags` again: requested tags are now authorized against the authenticating user, not the tag-owned node's absent user [#3374](https://github.com/juanfont/headscale/issues/3374)
 
 ## 0.29.2 (2026-07-01)
 

hscontrol/policy/pm.go

@@ -30,6 +30,12 @@ type PolicyManager interface {
 	// NodeCanHaveTag reports whether the given node can have the given tag.
 	NodeCanHaveTag(node types.NodeView, tag string) bool
 
+	// UserCanHaveTag reports whether the given user owns the given tag, i.e.
+	// is listed (directly or via a group) in the tag's tagOwners. This is the
+	// user half of NodeCanHaveTag, used to authorise re-auth tag changes
+	// against the authenticating user rather than the node's stale ownership.
+	UserCanHaveTag(user types.UserView, tag string) bool
+
 	// TagExists reports whether the given tag is defined in the policy.
 	TagExists(tag string) bool
 

hscontrol/policy/v2/policy.go

@@ -972,6 +972,37 @@ func (pm *PolicyManager) NodeCanHaveTag(node types.NodeView, tag string) bool {
 	return false
 }
 
+// UserCanHaveTag reports whether the given user is one of the tag's owners
+// (directly or via a group). It is the user half of [PolicyManager.NodeCanHaveTag]:
+// re-authentication authorises requested tags against the authenticating user,
+// because a tag-owned node carries no user and its IP is not in any owner set,
+// so only the user presenting the credential can prove ownership.
+func (pm *PolicyManager) UserCanHaveTag(user types.UserView, tag string) bool {
+	if pm == nil || !user.Valid() {
+		return false
+	}
+
+	pm.mu.RLock()
+	defer pm.mu.RUnlock()
+
+	if pm.pol == nil {
+		return false
+	}
+
+	owners, exists := pm.pol.TagOwners[Tag(tag)]
+	if !exists {
+		return false
+	}
+
+	for _, owner := range owners {
+		if pm.userMatchesOwner(user, owner) {
+			return true
+		}
+	}
+
+	return false
+}
+
 // TagOwnedByTags reports whether a credential holding ownerTags is authorised to
 // apply tag. It is true when tag is one of ownerTags, or when tag's tagOwners
 // chain (tag-to-tag ownership) transitively includes one of ownerTags. This is