[Bug] Exit node not visible when rule is matched with `via` tag

[vdovhanych]

Is this a support request?

• This is not a support request

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Exit node not offered to viewers whose only matching grant uses via (0.29.2)

Environment

• Headscale version: 0.29.2
• Policy mode: Database
• Database: sqlite
• Deployment: bare metal
• Clients: Tailscale on macOS, 1.98.5 (admin) and 1.98.5 (affected user)

Summary

A grant of the form:

{
  "src": ["autogroup:member"],
  "dst": ["autogroup:internet"],
  "via": ["tag:exit"],
  "ip": ["*"]
}

does not cause a tag-carrying exit node to be offered to viewers who match it. The affected clients report "No Exit Nodes Available".

Users who reach the same exit node through a separate, non-via rule (in our case group:admins → dst: ["*"]) see and use it without any problem. Removing via from the grant makes the exit node appear for all members immediately.

Expected Behavior

Users who match the rule should see all exit nodes that carrie that tag.

Steps To Reproduce

Reproduction

Minimal policy:

{
  "tagOwners": {
    "tag:exit": ["admin@example.com"]
  },
  "autoApprovers": {
    "exitNode": ["tag:exit"]
  },
  "groups": {
    "group:admins": ["admin@example.com"]
  },
  "grants": [
    {
      "src": ["group:admins"],
      "dst": ["*"],
      "ip": ["*"]
    },
    {
      "src": ["autogroup:member"],
      "dst": ["autogroup:internet"],
      "via": ["tag:exit"],
      "ip": ["*"]
    }
  ]
}

1. Register a node, tag it tag:exit, advertise 0.0.0.0/0 and ::/0. Confirm both are approved (headscale nodes list-routes).
2. Log in as admin@example.com (matches grant 1). The exit node is listed and works.
3. Log in as any other user. Their node is untagged, so it resolves into autogroup:member and matches grant 2 only.
4. Expected: the exit node is offered, restricted to nodes carrying tag:exit.
5. Actual: "No Exit Nodes Available". The exit node is not selectable.
6. Replace grant 2 with the same rule minus via — the exit node appears for that user immediately.

Environment

- OS: NixOS
- Headscale version: 0.29.2
- Tailscale version: 1.98.5

Runtime environment

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

Debug information

Can't share debug files, it's from the "production" server. Happy to check anything, though.