policy/v2: refuse autogroup:member as an sshTests destination

Tailscale SaaS refuses it when parsing; headscale evaluated it.

hscontrol/policy/v2/sshtester_compat_test.go

@@ -31,9 +31,6 @@ var knownSSHTesterDivergences = map[string]string{
 	"sshtest-report-multi/label":                       sshTestNodeLabel,
 	"sshtest-src-unassigned-ip-accept/label":           sshTestNodeLabel,
 
-	"sshtest-fail-label-autogroup-member/message": sshTestDstMember,
-	"sshtest-check-reason-mixed-alias/message":    sshTestDstMember,
-
 	"sshtest-fail-label-same-node-twice/breakdown": "SSHTEST_PER_ALIAS: SaaS reports each dst alias, also two naming one node; headscale checks each node once",
 	"sshtest-fail-label-ip-no-device/breakdown":    sshTestNoDevice,
 	"sshtest-report-multi/breakdown":               "SSHTEST_PER_ALIAS+SSHTEST_NO_DEVICE: SaaS reports one line per dst alias and a deviceless alias as not reached; headscale one per node and an error",
@@ -42,7 +39,6 @@ var knownSSHTesterDivergences = map[string]string{
 
 const (
 	sshTestNodeLabel = "SSHTEST_NODE_LABEL: headscale names each failing dst node by hostname; SaaS names the dst as written"
-	sshTestDstMember = "SSHTEST_DST_MEMBER: SaaS refuses autogroup:member as an sshTests destination when parsing; headscale evaluates it"
 	sshTestNoDevice  = "SSHTEST_NO_DEVICE: SaaS reports a dst that selects no device as not reached; headscale as an error"
 )
 

hscontrol/policy/v2/types.go

@@ -3455,7 +3455,8 @@ func isAddressRange(pol *Policy, alias Alias) bool {
 //
 //   - `host:port` suffixes (parsed as an unknown tag),
 //   - multi-host CIDRs (raw `/N` or a hosts: entry resolving wider),
-//   - autogroup:internet (valid as ACL dst only).
+//   - autogroup:internet (valid as ACL dst only),
+//   - autogroup:member, which Tailscale SaaS refuses here.
 //
 // A bare IP literal (single-host /BitLen prefix) is accepted. Tag
 // entries must exist in tagOwners.
@@ -3468,9 +3469,8 @@ func validateSSHTestDestination(pol *Policy, alias Alias) error {
 
 	switch a := alias.(type) {
 	case *AutoGroup:
-		// autogroup:internet is the only autogroup not valid here;
-		// member/tagged/self/nonroot pass to engine evaluation.
-		if *a == AutoGroupInternet {
+		// tagged/self/nonroot pass to engine evaluation.
+		if *a == AutoGroupInternet || *a == AutoGroupMember {
 			return fmt.Errorf("%w %q", ErrSSHTestDstDisallowedElement, dst)
 		}
 

hscontrol/policy/v2/types_test.go

@@ -6077,6 +6077,18 @@ func TestUnmarshalPolicySSHTests(t *testing.T) {
     {"src": "thor@example.org", "dst": ["autogroup:internet"], "accept": ["root"]}
   ]
 }
+`,
+			wantErr: ErrSSHTestDstDisallowedElement,
+		},
+		{
+			name: "dst-autogroup-member",
+			input: `
+{
+  "tagOwners": {"tag:server": ["admin@example.org"]},
+  "sshTests": [
+    {"src": "thor@example.org", "dst": ["autogroup:member"], "accept": ["root"]}
+  ]
+}
 `,
 			wantErr: ErrSSHTestDstDisallowedElement,
 		},