feat: Add DNS zones, identity providers, instance, and jobs commands

[TechHutTV]

Add support for four new NetBird API resource types:

• DNS Zones: Full CRUD operations for DNS zones and records
• Identity Providers: Manage OIDC/OAuth identity providers
• Instance: Query instance information (no auth required)
• Jobs: Monitor and manage background jobs

Enhanced existing commands:

• Accounts: Additional account management operations
• Peers: Extended peer query and management capabilities
• Users: Additional user management operations

Documentation:

• Added comprehensive docs for all new commands
• Updated API reference with new endpoints
• Updated README with new command examples

This completes additional API coverage beyond the initial 14 resource types.

Testing:

• go build ./cmd/netbird-manage compiles cleanly
• go vet ./... passes with no issues
• netbird-manage peer --list shows new DNS Label and Country columns
• netbird-manage peer --inspect <id> shows new fields (connection IP, kernel, local flags, etc.)
• netbird-manage user --me shows new fields (is_current, pending_approval, etc.)
• netbird-manage account --list --output json returns restructured settings with nested extra
• netbird-manage user --approve <id> works correctly
• netbird-manage user --reject <id> works correctly
• netbird-manage user --change-password <id> --old-password <pw> --new-password <pw> works
• netbird-manage peer --temp-access <id> --temp-name test --wg-pub-key <key> --rules <ids> works
• netbird-manage dns-zone --list works
• netbird-manage dns-zone --create <name> --domain <domain> --groups <ids> works
• netbird-manage dns-zone --inspect <id> works
• netbird-manage dns-zone --delete <id> shows confirmation prompt
• netbird-manage dns-zone --add-record <zone-id> --name test --type A --content 10.0.0.1 works
• netbird-manage dns-zone --list-records <zone-id> works
• netbird-manage dns-zone --delete-record --zone-id <id> --record-id <id> shows confirmation
• netbird-manage idp --list works
• netbird-manage idp --create <name> --type oidc --issuer <url> --client-id <id> --client-secret <secret> works
• netbird-manage idp --inspect <id> works
• netbird-manage idp --delete <id> shows confirmation prompt
• netbird-manage instance --status works without authentication
• netbird-manage instance --setup --email <email> --password <pw> --name <name> works
• netbird-manage job --list <peer-id> works
• netbird-manage job --create <peer-id> works
• netbird-manage job --inspect --peer-id <id> --job-id <id> works
• All new commands show usage when run without flags
• netbird-manage --help lists all new commands
• All --output json flags work for new commands

---

Note

Medium Risk
Adds multiple new management endpoints (including instance setup without auth) and broadens request/response models, which could impact API compatibility and operational safety if payload shapes or flags are incorrect.

Overview
Adds new CLI surface area for DNS zones/records (dns-zone), identity provider CRUD (idp), instance status/setup without authentication (instance), and peer-scoped jobs/bundle collection (job), wiring them into main.go routing and --help/usage output.

Extends existing commands and models: peer gains --temp-access plus richer list/inspect fields; user adds approve/reject/password-change operations and prints additional fields; account output/update handling is updated to match nested settings.extra and new settings/onboarding fields. The HTTP client now omits the Authorization header when no token is set to support no-auth endpoints.

Updates API/reference and docs (README + new docs/*.md pages and ipa/* API guide/resources content) to reflect expanded coverage from 14 to 18 resource types.

^{Written by Cursor Bugbot for commit 3a9b5e5. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

User model Password field may leak in JSON output

Medium Severity

The User response model now includes a Password field with json:"password,omitempty". When user --list --output json or user --me --output json is used, the full User struct is marshaled via json.MarshalIndent. If the API ever returns a password field in its response (e.g., for embedded IdP users), it would be silently included in the CLI's JSON output. The Password field belongs only in request models like UserPasswordChangeRequest, not in the response deserialization model.

Additional Locations (1)

• internal/commands/users.go#L226-L233

 

[cursor]

Account update may reset Extra fields to zero values

Medium Severity

When --peer-approval-enabled or --traffic-logging is set on an account where Extra is nil in the API response, a new empty AccountSettingsExtra{} is created with only the one targeted field set. The entire Extra object — including UserApprovalRequired, NetworkTrafficLogsGroups, and NetworkTrafficPacketCounterEnabled — is then sent in the PUT request with zero values, potentially resetting server-side defaults or previously configured values that the GET response simply omitted.

Additional Locations (1)

• internal/commands/accounts.go#L336-L340