overte-org · ada-tv · Aug 7, 2026
diff --git a/domain-server/resources/describe-settings.json b/domain-server/resources/describe-settings.json
@@ -975,105 +975,6 @@
             }
           ]
         },
-        {
-          "name": "mac_permissions",
-          "type": "table",
-          "caption": "Permissions for Users with MAC Addresses",
-          "can_add_new_rows": true,
-          "groups": [
-            {
-              "label": "MAC Address",
-              "span": 1
-            },
-            {
-              "label": "Permissions <a data-toggle='tooltip' data-html='true' title='<p><strong>Domain-Wide MAC Permissions</strong></p><ul><li><strong>Connect</strong><br />Sets whether users with specific MACs can connect to the domain.</li><li><strong>Avatar Entities</strong><br />Sets whether users with specific MACs can use avatar entities on the domain.</li><li><strong>Lock / Unlock</strong><br />Sets whether users from specific MACs can change the &ldquo;locked&rdquo; property of an entity (either from on to off or off to on).</li><li><strong>Rez</strong><br />Sets whether users with specific MACs can create new entities.</li><li><strong>Rez Temporary</strong><br />Sets whether users with specific MACs can create new entities with a finite lifetime.</li><li><strong>Write Assets</strong><br />Sets whether users with specific MACs can make changes to the domain&rsquo;s asset-server assets.</li><li><strong>Ignore Max Capacity</strong><br />Sets whether users with specific MACs can connect even if the domain has reached or exceeded its maximum allowed agents.</li><li><strong>Replace Content</strong><br>Sets whether users with specific MACs can replace entire content sets by wiping existing domain content.</li><li><strong>Get and Set Private User Data</strong><br>Sets whether a user can get and set the privateUserData entity property.</li></ul><p>Note that permissions assigned to a specific MAC will supersede any parameter-level permissions that might otherwise apply to that user (from groups or standard permissions above). MAC address permissions are overriden if the user has their own row in the users section.</p>'>?</a>",
-              "span": 12
-            }
-          ],
-          "columns": [
-            {
-              "name": "permissions_id",
-              "label": ""
-            },
-            {
-              "name": "id_can_connect",
-              "label": "Connect",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_rez_avatar_entities",
-              "label": "Avatar Entities",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_adjust_locks",
-              "label": "Lock / Unlock",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_rez",
-              "label": "Rez",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_rez_tmp",
-              "label": "Rez Temporary",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_write_to_asset_server",
-              "label": "Write Assets",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_connect_past_max_capacity",
-              "label": "Ignore Max Capacity",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_kick",
-              "label": "Kick Users",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_replace_content",
-              "label": "Replace Content",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_get_and_set_private_user_data",
-              "label": "Get and Set Private User Data",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            },
-            {
-              "name": "id_can_view_asset_urls",
-              "label": "View Asset URLs",
-              "type": "checkbox",
-              "editable": true,
-              "default": false
-            }
-          ]
-        },
         {
           "name": "machine_fingerprint_permissions",
           "type": "table",

diff --git a/domain-server/src/DomainGatekeeper.cpp b/domain-server/src/DomainGatekeeper.cpp
@@ -145,27 +145,23 @@ void DomainGatekeeper::processConnectRequestPacket(QSharedPointer<ReceivedMessag
         QMetaEnum metaEnum = QMetaEnum::fromType<LimitedNodeList::ConnectReason>();
         qDebug() << "Allowed connection from node" << uuidStringWithoutCurlyBraces(node->getUUID())
             << "on" << message->getSenderSockAddr()
-            << "with MAC" << nodeConnection.hardwareAddress
             << "and machine fingerprint" << nodeConnection.machineFingerprint
             << "user" << username
             << "reason" << QString(metaEnum.valueToKey(nodeConnection.connectReason))
-            << "previous connection uptime" << nodeConnection.previousConnectionUpTime/USECS_PER_MSEC << "msec"
-            << "sysinfo" << nodeConnection.SystemInfo;
+            << "previous connection uptime" << nodeConnection.previousConnectionUpTime/USECS_PER_MSEC << "msec";
 
         // signal that we just connected a node so the DomainServer can get it a list
         // and broadcast its presence right away
         emit connectedNode(node, message->getFirstPacketReceiveTime());
     } else {
         qDebug() << "Refusing connection from node at" << message->getSenderSockAddr()
-            << "with hardware address" << nodeConnection.hardwareAddress
-            << "and machine fingerprint" << nodeConnection.machineFingerprint
-            << "sysinfo" << nodeConnection.SystemInfo;
+            << "and machine fingerprint" << nodeConnection.machineFingerprint;
     }
 }
 
 NodePermissions DomainGatekeeper::setPermissionsForUser(bool isLocalUser, QString verifiedUsername,
                                                         QString verifiedDomainUserName, const QHostAddress& senderAddress,
-                                                        const QString& hardwareAddress, const QUuid& machineFingerprint) {
+                                                        const QUuid& machineFingerprint) {
     NodePermissions userPerms;
 
     userPerms.setAll(false);
@@ -203,14 +199,7 @@ NodePermissions DomainGatekeeper::setPermissionsForUser(bool isLocalUser, QStrin
 #ifdef WANT_DEBUG
         qDebug() << "|  user-permissions: unverified or no username for" << userPerms.getID() << ", so:" << userPerms;
 #endif
-        if (!hardwareAddress.isEmpty() && _server->_settingsManager.hasPermissionsForMAC(hardwareAddress)) {
-            // this user comes from a MAC we have in our permissions table, apply those permissions
-            userPerms = _server->_settingsManager.getPermissionsForMAC(hardwareAddress);
-
-#ifdef WANT_DEBUG
-            qDebug() << "|  user-permissions: specific MAC matches, so:" << userPerms;
-#endif
-        } else if (_server->_settingsManager.hasPermissionsForMachineFingerprint(machineFingerprint)) {
+        if (_server->_settingsManager.hasPermissionsForMachineFingerprint(machineFingerprint)) {
             userPerms = _server->_settingsManager.getPermissionsForMachineFingerprint(machineFingerprint);
 #ifdef WANT_DEBUG
             qDebug() << "| user-permissions: specific Machine Fingerprint matches, so: " << userPerms;
@@ -228,13 +217,6 @@ NodePermissions DomainGatekeeper::setPermissionsForUser(bool isLocalUser, QStrin
             userPerms = _server->_settingsManager.getPermissionsForName(verifiedUsername);
 #ifdef WANT_DEBUG
             qDebug() << "|  user-permissions: specific user matches, so:" << userPerms;
-#endif
-        } else if (!hardwareAddress.isEmpty() && _server->_settingsManager.hasPermissionsForMAC(hardwareAddress)) {
-            // this user comes from a MAC we have in our permissions table, apply those permissions
-            userPerms = _server->_settingsManager.getPermissionsForMAC(hardwareAddress);
-
-#ifdef WANT_DEBUG
-            qDebug() << "|  user-permissions: specific MAC matches, so:" << userPerms;
 #endif
         } else if (_server->_settingsManager.hasPermissionsForMachineFingerprint(machineFingerprint)) {
             userPerms = _server->_settingsManager.getPermissionsForMachineFingerprint(machineFingerprint);
@@ -359,13 +341,11 @@ void DomainGatekeeper::updateNodePermissions() {
             // or the public socket if we haven't activated a socket for the node yet
             SockAddr connectingAddr = node->getActiveSocket() ? *node->getActiveSocket() : node->getPublicSocket();
 
-            QString hardwareAddress;
             QUuid machineFingerprint;
             bool isLocalUser { false };
 
             DomainServerNodeData* nodeData = static_cast<DomainServerNodeData*>(node->getLinkedData());
             if (nodeData) {
-                hardwareAddress = nodeData->getHardwareAddress();
                 machineFingerprint = nodeData->getMachineFingerprint();
 
                 auto sendingAddress = nodeData->getSendingSockAddr().getAddress();
@@ -375,7 +355,7 @@ void DomainGatekeeper::updateNodePermissions() {
             }
 
             userPerms = setPermissionsForUser(isLocalUser, verifiedUsername, verifiedDomainUserName,
-                                              connectingAddr.getAddress(), hardwareAddress, machineFingerprint);
+                                              connectingAddr.getAddress(), machineFingerprint);
         }
 
         node->setPermissions(userPerms);
@@ -427,7 +407,6 @@ SharedNodePointer DomainGatekeeper::processAssignmentConnectRequest(const NodeCo
     // set assignment related data on the linked data for this node
     nodeData->setAssignmentUUID(matchingQueuedAssignment->getUUID());
     nodeData->setNodeVersion(it->second.getNodeVersion());
-    nodeData->setHardwareAddress(nodeConnection.hardwareAddress);
     nodeData->setMachineFingerprint(nodeConnection.machineFingerprint);
     // client-side send time of last connect/domain list request
     nodeData->setLastDomainCheckinTimestamp(nodeConnection.lastPingTimestamp);
@@ -545,7 +524,7 @@ SharedNodePointer DomainGatekeeper::processAgentConnectRequest(const NodeConnect
     }
 
     userPerms = setPermissionsForUser(isLocalUser, verifiedUsername, verifiedDomainUsername,
-                                      nodeConnection.senderSockAddr.getAddress(), nodeConnection.hardwareAddress,
+                                      nodeConnection.senderSockAddr.getAddress(),
                                       nodeConnection.machineFingerprint);
 
     if (!userPerms.can(NodePermissions::Permission::canConnectToDomain)) {
@@ -628,9 +607,6 @@ SharedNodePointer DomainGatekeeper::processAgentConnectRequest(const NodeConnect
     // if we have a username from the connect request, set it on the DomainServerNodeData
     nodeData->setUsername(username);
 
-    // set the hardware address passed in the connect request
-    nodeData->setHardwareAddress(nodeConnection.hardwareAddress);
-
     // set the machine fingerprint passed in the connect request
     nodeData->setMachineFingerprint(nodeConnection.machineFingerprint);
 

diff --git a/domain-server/src/DomainGatekeeper.h b/domain-server/src/DomainGatekeeper.h
@@ -136,7 +136,7 @@ private slots:
     QSet<QString> _inFlightGroupMembershipsRequests; // keep track of which we've already asked for
 
     NodePermissions setPermissionsForUser(bool isLocalUser, QString verifiedUsername, QString verifiedDomainUsername,
-                                          const QHostAddress& senderAddress, const QString& hardwareAddress, 
+                                          const QHostAddress& senderAddress,
                                           const QUuid& machineFingerprint);
 
     void getGroupMemberships(const QString& username);

diff --git a/domain-server/src/DomainServerNodeData.h b/domain-server/src/DomainServerNodeData.h
@@ -52,9 +52,6 @@ class DomainServerNodeData : public NodeData {
 
     void setNodeVersion(const QString& nodeVersion) { _nodeVersion = nodeVersion; }
     const QString& getNodeVersion() { return _nodeVersion; }
-
-    void setHardwareAddress(const QString& hardwareAddress) { _hardwareAddress = hardwareAddress; }
-    const QString& getHardwareAddress() { return _hardwareAddress; }
 
     void setMachineFingerprint(const QUuid& machineFingerprint) { _machineFingerprint = machineFingerprint; }
     const QUuid& getMachineFingerprint() { return _machineFingerprint; }
@@ -91,7 +88,6 @@ class DomainServerNodeData : public NodeData {
     bool _isAuthenticated = true;
     NodeSet _nodeInterestSet;
     QString _nodeVersion;
-    QString _hardwareAddress;
     QUuid   _machineFingerprint;
     quint64 _lastDomainCheckinTimestamp;
     QString _placeName;

diff --git a/domain-server/src/DomainServerSettingsManager.cpp b/domain-server/src/DomainServerSettingsManager.cpp
@@ -525,7 +525,7 @@ void DomainServerSettingsManager::setupConfigMap(const QString& userConfigFilena
             // Default values for new canRezAvatarEntities permission.
             unpackPermissions();
             std::list<std::unordered_map<NodePermissionsKey, NodePermissionsPointer, NodePermissionsKeyHash>> permissionsSets{
-                _standardAgentPermissions.get(),      _agentPermissions.get(), _ipPermissions.get(),  _macPermissions.get(),
+                _standardAgentPermissions.get(),      _agentPermissions.get(), _ipPermissions.get(),
                 _machineFingerprintPermissions.get(), _groupPermissions.get(), _groupForbiddens.get()
             };
             foreach (auto permissionsSet, permissionsSets) {
@@ -545,7 +545,7 @@ void DomainServerSettingsManager::setupConfigMap(const QString& userConfigFilena
             // Default values for new canViewAssetURLs permission.
             unpackPermissions();
             std::list<std::unordered_map<NodePermissionsKey, NodePermissionsPointer, NodePermissionsKeyHash>> permissionsSets{
-                _standardAgentPermissions.get(),      _agentPermissions.get(), _ipPermissions.get(),  _macPermissions.get(),
+                _standardAgentPermissions.get(),      _agentPermissions.get(), _ipPermissions.get(),
                 _machineFingerprintPermissions.get(), _groupPermissions.get(), _groupForbiddens.get()
             };
             foreach (auto permissionsSet, permissionsSets) {
@@ -668,9 +668,6 @@ void DomainServerSettingsManager::packPermissions() {
     // save settings for IP addresses
     packPermissionsForMap("permissions", _ipPermissions, IP_PERMISSIONS_KEYPATH);
 
-    // save settings for MAC addresses
-    packPermissionsForMap("permissions", _macPermissions, MAC_PERMISSIONS_KEYPATH);
-
     // save settings for Machine Fingerprint
     packPermissionsForMap("permissions", _machineFingerprintPermissions, MACHINE_FINGERPRINT_PERMISSIONS_KEYPATH);
 
@@ -749,17 +746,6 @@ void DomainServerSettingsManager::unpackPermissions() {
             }
     });
 
-    needPack |= unpackPermissionsForKeypath(MAC_PERMISSIONS_KEYPATH, &_macPermissions,
-        [&](NodePermissionsPointer perms){
-            // make sure that this permission row is for a non-empty hardware
-            if (perms->getKey().first.isEmpty()) {
-                _macPermissions.remove(perms->getKey());
-
-                // we removed a row from the MAC permissions, we'll need a re-pack
-                needPack = true;
-            }
-    });
-
     needPack |= unpackPermissionsForKeypath(MACHINE_FINGERPRINT_PERMISSIONS_KEYPATH, &_machineFingerprintPermissions,
         [&](NodePermissionsPointer perms){
             // make sure that this permission row has valid machine fingerprint
@@ -802,8 +788,7 @@ void DomainServerSettingsManager::unpackPermissions() {
     std::array<NodePermissionsMap*, 7> permissionsSets {{
         &_standardAgentPermissions, &_agentPermissions,
         &_groupPermissions, &_groupForbiddens,
-        &_ipPermissions, &_macPermissions,
-        &_machineFingerprintPermissions
+        &_ipPermissions, &_machineFingerprintPermissions
     }};
 
     foreach (auto permissionSet, permissionsSets) {
@@ -1120,16 +1105,6 @@ NodePermissions DomainServerSettingsManager::getPermissionsForIP(const QHostAddr
     return nullPermissions;
 }
 
-NodePermissions DomainServerSettingsManager::getPermissionsForMAC(const QString& macAddress) const {
-    NodePermissionsKey macKey = NodePermissionsKey(macAddress, 0);
-    if (_macPermissions.contains(macKey)) {
-        return *(_macPermissions[macKey].get());
-    }
-    NodePermissions nullPermissions;
-    nullPermissions.setAll(false);
-    return nullPermissions;
-}
-
 NodePermissions DomainServerSettingsManager::getPermissionsForMachineFingerprint(const QUuid& machineFingerprint) const {
     NodePermissionsKey fingerprintKey = NodePermissionsKey(machineFingerprint.toString(), 0);
     if (_machineFingerprintPermissions.contains(fingerprintKey)) {

diff --git a/domain-server/src/DomainServerSettingsManager.h b/domain-server/src/DomainServerSettingsManager.h
@@ -32,7 +32,6 @@ const QString SETTINGS_PATHS_KEY = "paths";
 const QString AGENT_STANDARD_PERMISSIONS_KEYPATH = "security.standard_permissions";
 const QString AGENT_PERMISSIONS_KEYPATH = "security.permissions";
 const QString IP_PERMISSIONS_KEYPATH = "security.ip_permissions";
-const QString MAC_PERMISSIONS_KEYPATH = "security.mac_permissions";
 const QString MACHINE_FINGERPRINT_PERMISSIONS_KEYPATH = "security.machine_fingerprint_permissions";
 const QString GROUP_PERMISSIONS_KEYPATH = "security.group_permissions";
 const QString GROUP_FORBIDDENS_KEYPATH = "security.group_forbiddens";
@@ -108,10 +107,6 @@ class DomainServerSettingsManager : public QObject {
     bool hasPermissionsForIP(const QHostAddress& address) const { return _ipPermissions.contains(address.toString(), 0); }
     NodePermissions getPermissionsForIP(const QHostAddress& address) const;
 
-    // these give access to permissions for specific MACs from the domain-server settings page
-    bool hasPermissionsForMAC(const QString& macAddress) const { return _macPermissions.contains(macAddress, 0); }
-    NodePermissions getPermissionsForMAC(const QString& macAddress) const;
-
     // these give access to permissions for specific machine fingerprints from the domain-server settings page
     bool hasPermissionsForMachineFingerprint(const QUuid& machineFingerprint) { return _machineFingerprintPermissions.contains(machineFingerprint.toString(), 0); }
     NodePermissions getPermissionsForMachineFingerprint(const QUuid& machineFingerprint) const;
@@ -237,7 +232,6 @@ private slots:
     NodePermissionsMap _agentPermissions; // specific account-names
 
     NodePermissionsMap _ipPermissions; // permissions granted by node IP address
-    NodePermissionsMap _macPermissions; // permissions granted by node MAC address
     NodePermissionsMap _machineFingerprintPermissions; // permissions granted by Machine Fingerprint
 
     NodePermissionsMap _groupPermissions; // permissions granted by membership to specific groups

diff --git a/domain-server/src/NodeConnectionData.cpp b/domain-server/src/NodeConnectionData.cpp
@@ -31,6 +31,7 @@ NodeConnectionData NodeConnectionData::fromDataStream(QDataStream& dataStream, c
         // NOTE: QDataStream::readBytes() - The buffer is allocated using new []. Destroy it with the delete [] operator.
         delete[] rawBytes;
 
+        // PROTOCOL TODO: remove the mac address and system info fields entirely
         // read the hardware address sent by the client
         dataStream >> newHeader.hardwareAddress;
 
@@ -40,9 +41,6 @@ NodeConnectionData NodeConnectionData::fromDataStream(QDataStream& dataStream, c
         // and the operating system type
         QByteArray compressedSystemInfo;
         dataStream >> compressedSystemInfo;
-        if (!compressedSystemInfo.isEmpty()) {
-            newHeader.SystemInfo = qUncompress(compressedSystemInfo);
-        }
 
         dataStream >> newHeader.connectReason;
 

diff --git a/domain-server/src/NodeConnectionData.h b/domain-server/src/NodeConnectionData.h
@@ -32,7 +32,6 @@ class NodeConnectionData {
     QString placeName;
     QString hardwareAddress;
     QUuid machineFingerprint;
-    QString SystemInfo;
     quint32 connectReason;
     quint64 previousConnectionUpTime;
     QByteArray protocolVersion;