chore: update android-agent + server-core submodules

- android-agent: resolveAllowedIps safety net, null-config handling, file fallback - server-core: centralized Device.ResolveAllowedIPs()
2026-07-04 12:19:19 +07:00
parent 8719535f55
commit c204f75978
3 changed files with 14 additions and 4 deletions
@@ -158,11 +158,12 @@ HTTP + gRPC share port 8080 via `cmux`:

 ## ANTI-PATTERNS (THIS PROJECT)
 - **NEVER** `nft flush table` — only atomic add/remove
- **NEVER** commit temp/debug/test files (`nft-fix.sh`, `temp_*.txt` etc) in project root; use `./tests` folder
+- **NEVER** commit temp/debug/test files (`nft-fix.sh`, `temp_*.txt` etc) in project root; use `.tests/` folder
 - **NEVER** log plaintext or encryption keys
 - **NEVER** reopen completed phases/commits — fix forward only
 - **NEVER** rebuild `shared/crypto/encryptor.go` — copy identical file
- **NEVER** commit build artifacts (binaries, `dist/`)
+- **NEVER** commit build artifacts (binaries, `dist/`, APK, `.apk`, `.aab`)
+- **NEVER** leave temp/debug/test outputs in project root — all must go in `.tests/` folder
 - **NEVER** force push
 - **NEVER** create cross-phase workarounds

@@ -198,6 +199,15 @@ if d.AllowInternet {
 // Do NOT override with EndpointAllowedIPs here
 ```

+### Client-side AllowedIPs resolution (`Device.ResolveAllowedIPs()`)
+Centralized in `internal/models/models.go`. Used by `buildConfigUpdate()`, heartbeat, and provisioning.
+Priority chain:
+1. `AllowInternet` → `0.0.0.0/0`
+2. `EndpointAllowedIPs` (if set) → use as-is
+3. Fallback → compose `IPPoolCIDR, serverWGIP/32` (e.g. `10.172.21.0/24,10.172.21.1/32`)
+
+**Never** use `InternalIP/32` as client-side AllowedIPs — that value is server-side WireGuard kernel routing only.
+
 ### Database field: `endpoint_allowed_ips`
 - Used for **client config** and **firewall rules**
 - NOT used for server-side WireGuard kernel config