[management] login filter to fix multiple peers connected with the same pub key

[crn4]

Describe your changes

We discovered that multiple machines using the same public key caused continuous reconnections. This PR introduces a login filter cache to allow only one connection per public key at a time.

Issue ticket number and link

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• Extended the README / documentation, if necessary

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

[Copilot]

Pull Request Overview

This PR implements a login filter to enforce only one active connection per public key, integrates it into the account manager and gRPC server, and adds metrics and error handling for blocked requests.

• Introduce loginFilter with in-memory cache to track and block duplicate logins
• Wire loginFilter into DefaultAccountManager and gRPC Sync/Login handlers with metrics and logging
• Add new blocked-request counters and ErrPeerAlreadyLoggedIn error type

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
management/server/telemetry/grpc_metrics.go	Added metrics/counters and methods for blocked sync and login requests
management/server/status/error.go	Replaced ErrExtraSettingsNotFound creation and added ErrPeerAlreadyLoggedIn
management/server/mock_server/account_mock.go	Added AllowSyncFunc stub and default AllowSync implementation
management/server/loginfilter.go	Implemented loginFilter, allowLogin, addLogin, removeLogin
management/server/loginfilter_test.go	Unit tests covering filter behaviors
management/server/peer_test.go	Removed unused wireGuardPubKey field in test struct
management/server/grpcserver.go	Integrated filter checks into Sync and Login, with logging & metrics
management/server/account/manager.go	Exposed AllowSync in Manager interface
management/server/account.go	Added loginFilter field and invoked filter in SyncAndMarkPeer & OnPeerDisconnected

Comments suppressed due to low confidence (2)

management/server/grpcserver.go:472

• [nitpick] Using AllowSync for both sync and login flows can be confusing. Consider renaming to a more generic term (e.g. AllowConnection) or splitting into AllowSync and AllowLogin for clarity.

	if !s.accountManager.AllowSync(peerKey.String(), metahashed) {

management/server/loginfilter_test.go:119

• Add a test verifying that repeated calls to allowLogin with the same metaHash within the filterTimeout window return true as long as the peer isn’t banned.

	s.True(s.filter.allowLogin(pubKey, meta2))

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
2 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud