From 2d327169b6d6b835f71ff31fcc313762b0268121 Mon Sep 17 00:00:00 2001
From: BlackDex <black.dex@gmail.com>
Date: Sun, 22 Mar 2026 17:59:52 +0100
Subject: [PATCH] Adjust code a bit and add Diagnostics check

Signed-off-by: BlackDex <black.dex@gmail.com>
---
 src/api/admin.rs                           | 10 +++++++++-
 src/config.rs                              |  7 +++----
 src/static/scripts/admin_diagnostics.js    |  7 +++++++
 src/static/templates/admin/diagnostics.hbs |  8 ++++++++
 src/util.rs                                |  3 +++
 5 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index badfaa3a..475797a7 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -32,7 +32,7 @@ use crate::{
     mail,
     util::{
         container_base_image, format_naive_datetime_local, get_active_web_release, get_display_size,
-        is_running_in_container, NumberOrString,
+        is_running_in_container, parse_experimental_client_feature_flags, FeatureFlagFilter, NumberOrString,
     },
     CONFIG, VERSION,
 };
@@ -734,6 +734,13 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
 
     let ip_header_name = &ip_header.0.unwrap_or_default();
 
+    let invalid_feature_flags: Vec<String> = parse_experimental_client_feature_flags(
+        &CONFIG.experimental_client_feature_flags(),
+        FeatureFlagFilter::InvalidOnly,
+    )
+    .into_keys()
+    .collect();
+
     let diagnostics_json = json!({
         "dns_resolved": dns_resolved,
         "current_release": VERSION,
@@ -756,6 +763,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
         "db_version": get_sql_server_version(&conn).await,
         "admin_url": format!("{}/diagnostics", admin_url()),
         "overrides": &CONFIG.get_overrides().join(", "),
+        "invalid_feature_flags": invalid_feature_flags,
         "host_arch": env::consts::ARCH,
         "host_os":  env::consts::OS,
         "tz_env": env::var("TZ").unwrap_or_default(),
diff --git a/src/config.rs b/src/config.rs
index 6a90c3c3..6ff09467 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1029,10 +1029,8 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         }
     }
 
-    let configured_flags =
-        parse_experimental_client_feature_flags(&cfg.experimental_client_feature_flags, FeatureFlagFilter::Unfiltered);
-    let invalid_flags: Vec<&str> =
-        configured_flags.keys().map(String::as_str).filter(|flag| !SUPPORTED_FEATURE_FLAGS.contains(flag)).collect();
+    let invalid_flags =
+        parse_experimental_client_feature_flags(&cfg.experimental_client_feature_flags, FeatureFlagFilter::InvalidOnly);
     if !invalid_flags.is_empty() {
         let feature_flags_error = format!("Unrecognized experimental client feature flags: {:?}.\n\
                      Please ensure all feature flags are spelled correctly and that they are supported in this version.\n\
@@ -1475,6 +1473,7 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "pm-5594-safari-account-switching",
     // Autofill Team
     "ssh-agent",
+    "ssh-agent-v2",
     // Key Management Team
     "ssh-key-vault-item",
     "pm-25373-windows-biometrics-v2",
diff --git a/src/static/scripts/admin_diagnostics.js b/src/static/scripts/admin_diagnostics.js
index 5594b439..2cff4410 100644
--- a/src/static/scripts/admin_diagnostics.js
+++ b/src/static/scripts/admin_diagnostics.js
@@ -109,6 +109,9 @@ async function generateSupportString(event, dj) {
         supportString += "* Websocket Check: disabled\n";
     }
     supportString += `* HTTP Response Checks: ${httpResponseCheck}\n`;
+    if (dj.invalid_feature_flags != "") {
+        supportString += `* Invalid feature flags: true\n`;
+    }
 
     const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
         "headers": { "Accept": "application/json" }
@@ -128,6 +131,10 @@ async function generateSupportString(event, dj) {
         supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
     }
 
+    if (dj.invalid_feature_flags != "") {
+        supportString += `\n**Invalid feature flags:** ${dj.invalid_feature_flags}\n`;
+    }
+
     // Add http response check messages if they exists
     if (httpResponseCheck === false) {
         supportString += "\n**Failed HTTP Checks:**\n";
diff --git a/src/static/templates/admin/diagnostics.hbs b/src/static/templates/admin/diagnostics.hbs
index 77f2c95b..d27bce4c 100644
--- a/src/static/templates/admin/diagnostics.hbs
+++ b/src/static/templates/admin/diagnostics.hbs
@@ -194,6 +194,14 @@
                     <dd class="col-sm-7">
                         <span id="http-response-errors" class="d-block"></span>
                     </dd>
+                    {{#if page_data.invalid_feature_flags}}
+                    <dt class="col-sm-5">Invalid Feature Flags
+                        <span class="badge bg-warning text-dark abbr-badge" id="feature-flag-warning" title="Some feature flags are invalid or outdated!">Warning</span>
+                    </dt>
+                    <dd class="col-sm-7">
+                        <span id="feature-flags" class="d-block"><b>Flags:</b> <span id="feature-flags-string">{{page_data.invalid_feature_flags}}</span></span>
+                    </dd>
+                    {{/if}}
                 </dl>
             </div>
         </div>
diff --git a/src/util.rs b/src/util.rs
index a9bbdbc8..d336689d 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -769,8 +769,10 @@ pub fn convert_json_key_lcase_first(src_json: Value) -> Value {
 }
 
 pub enum FeatureFlagFilter {
+    #[allow(dead_code)]
     Unfiltered,
     ValidOnly,
+    InvalidOnly,
 }
 
 /// Parses the experimental client feature flags string into a HashMap.
@@ -785,6 +787,7 @@ pub fn parse_experimental_client_feature_flags(
         .filter(|flag| match filter_mode {
             FeatureFlagFilter::Unfiltered => true,
             FeatureFlagFilter::ValidOnly => SUPPORTED_FEATURE_FLAGS.contains(flag),
+            FeatureFlagFilter::InvalidOnly => !SUPPORTED_FEATURE_FLAGS.contains(flag),
         })
         .map(|flag| (flag.to_owned(), true))
         .collect()