WIP

Change-Id: I64d34d15a040475b558444a9b52572879eb5bc54
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

control/controlclient/direct.go

@@ -398,6 +398,9 @@ func (c *Direct) TryLogout(ctx context.Context) error {
 }
 
 func (c *Direct) TryLogin(ctx context.Context, t *tailcfg.Oauth2Token, flags LoginFlags) (url string, err error) {
+	if strings.Contains(c.serverURL, "controlplane") {
+		panic("XXX controlclient: TryLogin called on controlplane server")
+	}
 	c.logf("[v1] direct.TryLogin(token=%v, flags=%v)", t != nil, flags)
 	return c.doLoginOrRegen(ctx, loginOpt{Token: t, Flags: flags})
 }

net/tshttpproxy/tshttpproxy.go

@@ -142,6 +142,9 @@ func ProxyFromEnvironment(req *http.Request) (ret *url.URL, _ error) {
 			return
 		}
 		log.Printf("tshttpproxy: using proxy %q for URL: %q", ss, req.URL.String())
+		if strings.HasPrefix(req.URL.String(), "https://controlplane.tailscale.com/key") {
+			panic("XXX saw controlplane.tailscale.com/key in test")
+		}
 		mak.Set(&logMessagePrinted, ss, true)
 	}()