[client] Fix daemon lock order inversion between SetConfig and login

[lixmal]

Describe your changes

SetConfig and the login path acquired the daemon's server mutex and the guarded-config mutex in opposite orders, so two concurrent daemon requests could wedge each other permanently. SetConfig now takes the guarded-config mutex first, matching the login path, which gives the two locks a single order across the daemon.

• Fix the lock order inversion between SetConfig and login by acquiring the guarded-config lock before the server lock
• Add a test that fails on the old order

Issue ticket number and link

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Internal locking fix with no user-visible surface.

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

Summary by CodeRabbit

• Bug Fixes

  • Improved configuration updates to prevent potential deadlocks during concurrent login and configuration operations.
  • Preserved existing validation and configuration update behavior.

• Tests

  • Added coverage to verify safe lock ordering during configuration changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a27cff55-addb-4254-8ce6-cf00a2a7634f

📥 Commits

Reviewing files that changed from the base of the PR and between 1bf54dd and 05f713b.

📒 Files selected for processing (2)

• client/server/lock_order_test.go
• client/server/server.go

---

📝 Walkthrough

Walkthrough

SetConfig now acquires guardedConfigMu before s.mutex, with comments documenting the lock order. A concurrency regression test verifies that s.mutex remains available while guardedConfigMu is held.

Changes

SetConfig lock ordering

Layer / File(s)	Summary
SetConfig lock ordering and regression test client/server/server.go, client/server/lock_order_test.go	SetConfig acquires guardedConfigMu earlier and removes the later duplicate lock block. The new test verifies the mutex ordering and successful completion.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: pappz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the lock-order fix between SetConfig and login.
Description check	✅ Passed	The description follows the template and covers the change, checklist, stack, and docs, but leaves the issue ticket section blank.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-setconfig-login-lock-order

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Release artifacts

Built for PR head 05f713b in workflow run #17282.

Artifact	Link
All release artifacts	Download
Linux packages	Download
Windows packages	Download
macOS packages	Download
UI artifacts	Download
UI macOS artifacts	Download

GHCR images (amd64)

• ghcr.io/netbirdio/management:pr-6978
• ghcr.io/netbirdio/netbird-server:pr-6978
• ghcr.io/netbirdio/netbird:pr-6978
• ghcr.io/netbirdio/relay:pr-6978
• ghcr.io/netbirdio/reverse-proxy:pr-6978
• ghcr.io/netbirdio/signal:pr-6978
• ghcr.io/netbirdio/upload:pr-6978

This comment is updated by the Release workflow. Artifact links expire according to the workflow retention policy.

[riccardomanfrin]

guardedConfigMu covers also checkUpdateSettingsDisabled() and loadMDMPolicy() which read from system so login takes lock, SetConfig will take more time.

Test covers only one direction / order (thouth it's the canonical one). might be good to do another with inverted direction.

SetConfig is stale if t.Fatal fires (line 48) but it's terminating anyway so I guess it's fine..

This PR probably needs backport on 0.76.1 ?