fix(web): preserve expiration edits during remap

Author: wiresock

amneziawg-web/src/admin/script_bridge.rs

@@ -138,6 +138,22 @@ pub fn validate_client_name(name: &str) -> Result<(), ScriptError> {
     Ok(())
 }
 
+/// Return the stable installer client name encoded by a discovered config.
+///
+/// Installer-created configs use `<interface>-client-<name>.conf`. Generic
+/// config filenames must not be treated as lifecycle-managed users, even when
+/// their friendly name happens to be a valid client name.
+pub fn managed_client_name_from_config<'a>(
+    config_name: &str,
+    friendly_name: &'a str,
+) -> Option<&'a str> {
+    let (interface_name, filename_client_name) = config_name.rsplit_once("-client-")?;
+    (!interface_name.is_empty()
+        && filename_client_name == friendly_name
+        && validate_client_name(friendly_name).is_ok())
+    .then_some(friendly_name)
+}
+
 // ── Script bridge ────────────────────────────────────────────────────────────
 
 /// Bridge to the `amneziawg-install.sh` script for client lifecycle actions.
@@ -386,6 +402,23 @@ mod tests {
         assert!(validate_client_name("..").is_err());
     }
 
+    #[test]
+    fn managed_client_name_requires_installer_filename_shape() {
+        assert_eq!(
+            managed_client_name_from_config("awg0-client-alice", "alice"),
+            Some("alice")
+        );
+        assert_eq!(managed_client_name_from_config("alice", "alice"), None);
+        assert_eq!(
+            managed_client_name_from_config("awg0-client-alice", "bob"),
+            None
+        );
+        assert_eq!(
+            managed_client_name_from_config("awg0-client-invalid.name", "invalid.name"),
+            None
+        );
+    }
+
     // ── build_args ───────────────────────────────────────────────────────
 
     #[test]

amneziawg-web/src/db/peers.rs

@@ -812,25 +812,33 @@ pub async fn clear_all_config_mappings(pool: &SqlitePool) -> Result<(), sqlx::Er
 /// Mark one peer as having a discovered config file.
 ///
 /// Sets `has_config = 1`, `config_name`, `config_path`, and `friendly_name`
-/// for the peer identified by `public_key`.  Returns `true` if a matching
-/// peer was found and updated, `false` if no peer with that public key
-/// exists (the config file may reference a key that does not correspond to
+/// for the peer identified by `public_key`. When config discovery proves the
+/// peer was created by the installer, `managed_client_name` stores that stable
+/// lifecycle identity if one has not already been recorded. Returns `true` if
+/// a matching peer was found and updated, `false` if no peer with that public
+/// key exists (the config file may reference a key that does not correspond to
 /// any known peer — for example the server's own public key).
 pub async fn apply_config_mapping(
     pool: &SqlitePool,
     public_key: &str,
     config_name: &str,
     config_path: &str,
     friendly_name: &str,
+    managed_client_name: Option<&str>,
 ) -> Result<bool, sqlx::Error> {
     let result = sqlx::query(
         "UPDATE peers
-         SET    has_config = 1, config_name = ?, config_path = ?, friendly_name = ?
+         SET    has_config = 1,
+                config_name = ?,
+                config_path = ?,
+                friendly_name = ?,
+                managed_client_name = COALESCE(managed_client_name, ?)
          WHERE  public_key = ? AND archived = 0",
     )
     .bind(config_name)
     .bind(config_path)
     .bind(friendly_name)
+    .bind(managed_client_name)
     .bind(public_key)
     .execute(pool)
     .await?;
@@ -1185,6 +1193,7 @@ mod tests {
             "awg0-client-gramm",
             "/etc/awg/awg0-client-gramm.conf",
             "gramm",
+            Some("gramm"),
         )
         .await
         .expect("apply mapping");
@@ -1198,6 +1207,14 @@ mod tests {
             Some("/etc/awg/awg0-client-gramm.conf")
         );
         assert_eq!(row.friendly_name.as_deref(), Some("gramm"));
+        assert_eq!(row.managed_client_name.as_deref(), Some("gramm"));
+
+        clear_all_config_mappings(&db.pool)
+            .await
+            .expect("clear transient mapping fields");
+        let row = find_by_id(&db.pool, id).await.unwrap().unwrap();
+        assert_eq!(row.has_config, 0);
+        assert_eq!(row.managed_client_name.as_deref(), Some("gramm"));
     }
 
     #[tokio::test]
@@ -1210,6 +1227,7 @@ mod tests {
             "ghost",
             "/etc/awg/ghost.conf",
             "ghost",
+            None,
         )
         .await
         .expect("should not error");
@@ -1230,6 +1248,7 @@ mod tests {
                 "idem-config",
                 "/etc/awg/idem.conf",
                 "idem-config",
+                None,
             )
             .await
             .unwrap();
@@ -1775,6 +1794,7 @@ mod tests {
             "reappeared",
             "/etc/amnezia/amneziawg/reappeared.conf",
             "reappeared",
+            None,
         )
         .await
         .unwrap());
@@ -2015,6 +2035,7 @@ mod tests {
             "awg0-client-stale",
             "/etc/amnezia/amneziawg/clients/awg0-client-stale.conf",
             "stale",
+            Some("stale"),
         )
         .await
         .expect("apply config mapping");

amneziawg-web/src/poller/mod.rs

@@ -529,6 +529,10 @@ async fn apply_config_mappings(
     let mut mapped_by_ip: usize = 0;
     for config in configs {
         let path_str = config.path.to_string_lossy();
+        let managed_client_name = crate::admin::script_bridge::managed_client_name_from_config(
+            &config.name,
+            &config.friendly_name,
+        );
 
         // ── Strategy 1: exact public-key match ──────────────────
         //
@@ -544,6 +548,7 @@ async fn apply_config_mappings(
                 &config.name,
                 &path_str,
                 &config.friendly_name,
+                managed_client_name,
             )
             .await
             {
@@ -603,6 +608,7 @@ async fn apply_config_mappings(
                     &config.name,
                     &path_str,
                     &config.friendly_name,
+                    managed_client_name,
                 )
                 .await
                 {

amneziawg-web/src/web/mod.rs

@@ -715,12 +715,8 @@ fn managed_client_name_for_expiration(row: &PeerRow) -> Option<&str> {
                 return None;
             }
             let config_name = row.config_name.as_deref()?;
-            let (interface_name, filename_client_name) = config_name.rsplit_once("-client-")?;
             let friendly_name = row.friendly_name.as_deref()?;
-            (!interface_name.is_empty()
-                && filename_client_name == friendly_name
-                && crate::admin::script_bridge::validate_client_name(friendly_name).is_ok())
-            .then_some(friendly_name)
+            crate::admin::script_bridge::managed_client_name_from_config(config_name, friendly_name)
         })
 }
 
@@ -6108,6 +6104,78 @@ mod tests {
         assert_eq!(row.managed_client_name.as_deref(), Some("alice"));
     }
 
+    #[tokio::test]
+    async fn expiration_edits_use_stable_identity_during_config_remap() {
+        let db = test_db().await;
+        let api_id = insert_peer(&db, "EXPIRY_REMAP_API_KEY=", Some("Alice")).await;
+        crate::db::peers::apply_config_mapping(
+            &db.pool,
+            "EXPIRY_REMAP_API_KEY=",
+            "awg0-client-alice",
+            "/etc/amnezia/amneziawg/clients/awg0-client-alice.conf",
+            "alice",
+            Some("alice"),
+        )
+        .await
+        .unwrap();
+        crate::db::peers::clear_all_config_mappings(&db.pool)
+            .await
+            .unwrap();
+
+        let html_id = insert_peer(&db, "EXPIRY_REMAP_HTML_KEY=", Some("Bob")).await;
+        crate::db::peers::apply_config_mapping(
+            &db.pool,
+            "EXPIRY_REMAP_HTML_KEY=",
+            "awg0-client-bob",
+            "/etc/amnezia/amneziawg/clients/awg0-client-bob.conf",
+            "bob",
+            Some("bob"),
+        )
+        .await
+        .unwrap();
+        crate::db::peers::clear_all_config_mappings(&db.pool)
+            .await
+            .unwrap();
+
+        let app = test_router(db.clone());
+        let response = app
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("PATCH")
+                    .uri(format!("/api/peers/{api_id}"))
+                    .header("content-type", "application/json")
+                    .body(Body::from(r#"{"expiration_days":7}"#))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri(format!("/peers/{html_id}"))
+                    .header("content-type", "application/x-www-form-urlencoded")
+                    .body(Body::from("display_name=Bob&comment=&expiration_days=7"))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::SEE_OTHER);
+
+        for (id, expected_name) in [(api_id, "alice"), (html_id, "bob")] {
+            let row = crate::db::peers::find_by_id(&db.pool, id)
+                .await
+                .unwrap()
+                .unwrap();
+            assert_eq!(row.has_config, 0);
+            assert_eq!(row.managed_client_name.as_deref(), Some(expected_name));
+            assert!(row.expires_at.is_some());
+        }
+    }
+
     #[tokio::test]
     async fn patch_peer_rejects_expiration_for_unmanaged_peer() {
         let db = test_db().await;
@@ -7314,6 +7382,7 @@ mod tests {
             "test-client",
             conf_path.to_str().unwrap(),
             "test-client",
+            None,
         )
         .await
         .unwrap();
@@ -7732,6 +7801,7 @@ mod tests {
             "existing-client",
             "/etc/amnezia/amneziawg/existing-client.conf",
             "existing-client",
+            None,
         )
         .await
         .unwrap());
@@ -7757,6 +7827,7 @@ mod tests {
             "test-dl",
             "/etc/awg/test-dl.conf",
             "test-dl",
+            None,
         )
         .await
         .unwrap();
@@ -8602,6 +8673,7 @@ mod tests {
             "test-qr",
             conf_path.to_str().unwrap(),
             "test-qr",
+            None,
         )
         .await
         .unwrap();
@@ -8664,6 +8736,7 @@ mod tests {
             "big-qr",
             conf_path.to_str().unwrap(),
             "big-qr",
+            None,
         )
         .await
         .unwrap();
@@ -8713,6 +8786,7 @@ mod tests {
             "test-qrui",
             "/etc/awg/test-qrui.conf",
             "test-qrui",
+            None,
         )
         .await
         .unwrap();
@@ -8822,6 +8896,7 @@ mod tests {
             "escaped",
             outside_conf.to_str().unwrap(),
             "escaped",
+            None,
         )
         .await
         .unwrap();
@@ -8859,6 +8934,7 @@ mod tests {
             "escaped-qr",
             outside_conf.to_str().unwrap(),
             "escaped-qr",
+            None,
         )
         .await
         .unwrap();
@@ -8900,6 +8976,7 @@ mod tests {
             "link",
             link_conf.to_str().unwrap(),
             "link",
+            None,
         )
         .await
         .unwrap();
@@ -8939,6 +9016,7 @@ mod tests {
             "link-qr",
             link_conf.to_str().unwrap(),
             "link-qr",
+            None,
         )
         .await
         .unwrap();