Merge remote-tracking branch 'origin/main' into fix_debug_upload_url_from_mgmt

# Conflicts:
#	client/proto/daemon.pb.go
#	management/internals/controllers/network_map/controller/controller.go
#	management/internals/controllers/network_map/nmaptest/runner.go
#	management/internals/shared/grpc/server.go
#	management/server/account.go
#	shared/management/proto/management.pb.go
#	upload-server/server/server.go

management/internals/controllers/network_map/controller/controller.go

@@ -24,7 +24,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/shared/requestbuffer"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -60,8 +59,6 @@ type Controller struct {
 
 	requestBuffer account.RequestBuffer
 
-	proxyController port_forwarding.Controller
-
 	integratedPeerValidator integrated_validator.IntegratedValidator
 
 	serverSupportedSyncMessageVersion sharedgrpc.SyncMessageVersion
@@ -87,7 +84,7 @@ type bufferAffectedUpdate struct {
 
 var _ network_map.Controller = (*Controller)(nil)
 
-func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, proxyController port_forwarding.Controller, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
+func NewController(ctx context.Context, store store.Store, metrics telemetry.AppMetrics, peersUpdateManager network_map.PeersUpdateManager, requestBuffer account.RequestBuffer, integratedPeerValidator integrated_validator.IntegratedValidator, settingsManager settings.Manager, dnsDomain string, ephemeralPeersManager ephemeral.Manager, config *config.Config, nmdataStore *networkmapdb.NetworkMapDBStoreImpl) *Controller {
 	nMetrics, err := newMetrics(metrics.UpdateChannelMetrics())
 	if err != nil {
 		log.Fatal(fmt.Errorf("error creating metrics: %w", err))
@@ -104,11 +101,10 @@ func NewController(ctx context.Context, store store.Store, metrics telemetry.App
 		dnsDomain:               dnsDomain,
 		config:                  config,
 
-		proxyController:                              proxyController,
 		EphemeralPeersManager:                        ephemeralPeersManager,
 		serverSupportedSyncMessageVersion:            sharedgrpc.SyncMessageVersionFromConfig(config.HighestSupportedSyncMessageVersion),
 		perAccountServerSupportedSyncMessageVersions: sharedgrpc.SyncMessageVersionsFromMap(config.PerAccountHighestSupportedSyncMessageVersion),
-		nmdataStore:                                  nmdataStore,
+		nmdataStore: nmdataStore,
 	}
 
 	if nmdataStore != nil {
@@ -131,14 +127,20 @@ func (c *Controller) OnPeerConnected(ctx context.Context, accountID string, peer
 	return c.peersUpdateManager.CreateChannel(ctx, peerID), nil
 }
 
-func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, peerID string) {
-	c.peersUpdateManager.CloseChannel(ctx, peerID)
+// OnPeerDisconnected closes the session's updates channel and schedules an ephemeral peer for
+// cleanup. It returns false without touching anything when a newer session owns the peer. A nil
+// session closes any registered channel.
+func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, peerID string, session chan *network_map.UpdateMessage) bool {
+	if !c.peersUpdateManager.CloseSessionChannel(ctx, peerID, session) {
+		return false
+	}
 	peer, err := c.repo.GetPeerByID(ctx, accountID, peerID)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get peer %s: %v", peerID, err)
-		return
+		return true
 	}
 	c.EphemeralPeersManager.OnPeerDisconnected(ctx, peer)
+	return true
 }
 
 // injectAllProxyPolicies prepares an account for the per-peer network-map
@@ -226,12 +228,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -273,7 +269,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 			start = time.Now()
 
 			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
 			var update *proto.SyncResponse
 
 			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
@@ -294,10 +289,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -313,10 +305,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
-			}
-
 			start = time.Now()
 			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
@@ -451,7 +439,7 @@ func (c *Controller) sendUpdatesFromData(ctx context.Context, accountID string,
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, nil, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort, c.config.DebugUpload.URL)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, p, nil, nil, components, dnsDomain, postureChecks, nmData.AccountSettings, extraSettings, peerGroups, dnsFwdPort, c.config.DebugUpload.URL)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -684,12 +672,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMapsAll(ctx, accountID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return fmt.Errorf("failed to get proxy network maps: %v", err)
-	}
-
 	extraSetting, err := c.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
 		return fmt.Errorf("failed to get flow enabled status: %v", err)
@@ -722,7 +704,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 			start = time.Now()
 
 			peerGroups := account.GetPeerGroups(p.ID)
-			proxyNetworkMap := proxyNetworkMaps[p.ID]
 			var update *proto.SyncResponse
 
 			commonSyncMessageVersion := sharedgrpc.HighestCommonSyncMessageVersion(
@@ -743,10 +724,7 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 				c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
 				start = time.Now()
-				// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-				// the client merges it into Calculate()'s output the same
-				// way the legacy server did via NetworkMap.Merge.
-				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
+				update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
 				c.metrics.CountToComponentSyncResponseDuration(time.Since(start))
 
 				c.peersUpdateManager.SendUpdate(ctx, p.ID, &network_map.UpdateMessage{
@@ -762,10 +740,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 
 			c.metrics.CountCalcPeerNetworkMapDuration(time.Since(start))
 
-			if proxyNetworkMap != nil {
-				nmap.Merge(proxyNetworkMap)
-			}
-
 			start = time.Now()
 			update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(p), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSetting, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
 			c.metrics.CountToSyncResponseDuration(time.Since(start))
@@ -843,19 +817,12 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("failed to get posture checks for peer %s: %v", peerId, err)
 	}
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return err
-	}
-
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to get account zones: %v", err)
 		return err
 	}
 
-	proxyNetworkMap := proxyNetworkMaps[peer.ID]
 	extraSettings, err := c.settingsManager.GetExtraSettings(ctx, peer.AccountID)
 	if err != nil {
 		return fmt.Errorf("failed to get extra settings: %v", err)
@@ -881,10 +848,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		components := account.GetPeerNetworkMapComponents(
 			ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
 
-		// proxyNetworkMap rides the envelope as a ProxyPatch sidecar;
-		// the client merges it into Calculate()'s output the same
-		// way the legacy server did via NetworkMap.Merge.
-		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, proxyNetworkMap, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
+		update = grpc.ToComponentSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, components, dnsDomain, postureChecks, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
 
 		c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
 			Update:      update,
@@ -897,10 +861,6 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 	nmap := account.GetPeerNetworkMapFromComponents(
 		ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	if proxyNetworkMap != nil {
-		nmap.Merge(proxyNetworkMap)
-	}
-
 	update = grpc.ToSyncResponse(ctx, nil, c.config.HttpConfig, c.config.DeviceAuthorizationFlow, types.TwinPeer(peer), nil, nil, nmap, dnsDomain, postureChecks, dnsCache, types.TwinAccountSettings(account.Settings), extraSettings, maps.Keys(peerGroups), dnsFwdPort, c.config.DebugUpload.URL)
 
 	c.peersUpdateManager.SendUpdate(ctx, peer.ID, &network_map.UpdateMessage{
@@ -951,17 +911,16 @@ func (c *Controller) BufferUpdateAccountPeers(ctx context.Context, accountID str
 
 // GetValidatedPeerWithComponents is the components-format counterpart of
 // GetValidatedPeerWithMap. It returns raw NetworkMapComponents for capable
-// peers along with the proxy NetworkMap fragment (BYOP / port-forwarding
-// data the legacy server folds in via NetworkMap.Merge). The gRPC layer
-// encodes both into the wire envelope. Callers must gate on capability
-// themselves before dispatching here — this method does NOT branch on it.
-func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+// peers, which the gRPC layer encodes into the wire envelope. Callers must
+// gate on capability themselves before dispatching here — this method does
+// NOT branch on it.
+func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, peer *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	if isRequiresApproval {
 		network, err := c.repo.GetAccountNetwork(ctx, accountID)
 		if err != nil {
-			return nil, nil, nil, nil, 0, err
+			return nil, nil, nil, 0, err
 		}
-		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, nil, 0, nil
+		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, 0, nil
 	}
 
 	if nmData := c.getNetworkMapData(ctx, accountID); nmData != nil {
@@ -970,39 +929,29 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	// it's possible that the peer gets deleted between the call to "sendInitialSync()" and here, bail out in this case
 	if _, ok := account.Peers[peer.ID]; !ok {
-		return nil, nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
+		return nil, nil, nil, 0, fmt.Errorf("peer '%s' no longer exists", peer.ID)
 	}
 
 	c.injectAllProxyPolicies(ctx, account)
 
 	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, types.TwinGroups(maps.Values(account.Groups)), types.TwinPeers(maps.Values(account.Peers)), account.Settings.Extra)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	postureChecks, err := c.getPeerPostureChecks(account, peer.ID)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	accountZones, err := c.repo.GetAccountZones(ctx, account.Id)
 	if err != nil {
-		return nil, nil, nil, nil, 0, err
-	}
-
-	// Fetch the proxy network map fragment for this peer alongside the
-	// components — same single-account-load path the streaming controller
-	// uses, so initial-sync delivers BYOP/forwarding patches synchronously
-	// instead of waiting for the next streaming push.
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peer.ID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, nil, nil, 0, err
+		return nil, nil, nil, 0, err
 	}
 
 	dnsDomain := c.GetDNSDomain(account.Settings)
@@ -1014,13 +963,12 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 	components := account.GetPeerNetworkMapComponents(ctx, peer.ID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
-	return peer, components, proxyNetworkMaps[peer.ID], postureChecks, dnsFwdPort, nil
+	return peer, components, postureChecks, dnsFwdPort, nil
 }
 
 // getValidatedPeerWithComponentsFromData is the account-free variant of
-// GetValidatedPeerWithComponents. The proxy network map fragment is omitted
-// like on the other nmdata paths.
-func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+// GetValidatedPeerWithComponents.
+func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context, accountID string, peer *nbpeer.Peer, nmData *networkmap.NetworkMapData) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	postureChecks := peerPostureChecksFromData(nmData, peer.ID)
 
 	dnsDomain := c.getDNSDomainFromData(nmData.AccountSettings)
@@ -1029,7 +977,7 @@ func (c *Controller) getValidatedPeerWithComponentsFromData(ctx context.Context,
 	components := nmData.GetPeerNetworkMapComponents(peer.ID, peersCustomZone)
 	dnsFwdPort := ComputeForwarderPortFromData(nmData.Peers, network_map.DnsForwarderPortMinVersion)
 
-	return peer, components, nil, postureChecks, dnsFwdPort, nil
+	return peer, components, postureChecks, dnsFwdPort, nil
 }
 
 // BufferUpdateAffectedPeers accumulates peer IDs and flushes them after the buffer interval.
@@ -1173,22 +1121,11 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, nil, 0, err
-	}
-
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, peersCustomZone, accountZones, approvedPeersMap, resourcePolicies, routers, c.accountManagerMetrics, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peerID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	dnsFwdPort := computeForwarderPort(maps.Values(account.Peers), network_map.DnsForwarderPortMinVersion)
 
 	return networkMap, postureChecks, dnsFwdPort, nil
@@ -1457,23 +1394,12 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
 
-	proxyNetworkMaps, err := c.proxyController.GetProxyNetworkMaps(ctx, account.Id, peerID, account.Peers)
-	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get proxy network maps: %v", err)
-		return nil, err
-	}
-
 	c.injectAllProxyPolicies(ctx, account)
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
 	networkMap := account.GetPeerNetworkMapFromComponents(ctx, peer.ID, peersCustomZone, accountZones, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
 
-	proxyNetworkMap, ok := proxyNetworkMaps[peer.ID]
-	if ok {
-		networkMap.Merge(proxyNetworkMap)
-	}
-
 	return networkMap, nil
 }
 

management/internals/controllers/network_map/controller/controller_disconnect_test.go

@@ -0,0 +1,78 @@
+package controller
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+type recordingEphemeralManager struct {
+	disconnected []string
+}
+
+func (r *recordingEphemeralManager) LoadInitialPeers(context.Context)              {}
+func (r *recordingEphemeralManager) Stop()                                         {}
+func (r *recordingEphemeralManager) OnPeerConnected(context.Context, *nbpeer.Peer) {}
+func (r *recordingEphemeralManager) OnPeerDisconnected(_ context.Context, peer *nbpeer.Peer) {
+	r.disconnected = append(r.disconnected, peer.ID)
+}
+
+func TestOnPeerDisconnected_OwnSession(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(gomock.NewController(t))
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: repo, peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	session := updateManager.CreateChannel(ctx, "peer-1")
+	repo.EXPECT().GetPeerByID(gomock.Any(), "account-1", "peer-1").Return(&nbpeer.Peer{ID: "peer-1", Ephemeral: true}, nil)
+
+	require.True(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", session))
+	assert.False(t, updateManager.HasChannel("peer-1"))
+	assert.Equal(t, []string{"peer-1"}, ephemeralManager.disconnected)
+}
+
+func TestOnPeerDisconnected_NilSessionClosesOlderChannel(t *testing.T) {
+	ctx := context.Background()
+	repo := NewMockRepository(gomock.NewController(t))
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: repo, peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	older := updateManager.CreateChannel(ctx, "peer-1")
+	repo.EXPECT().GetPeerByID(gomock.Any(), "account-1", "peer-1").Return(&nbpeer.Peer{ID: "peer-1", Ephemeral: true}, nil)
+
+	require.True(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", nil))
+	assert.False(t, updateManager.HasChannel("peer-1"))
+	_, open := <-older
+	assert.False(t, open, "older channel must be closed")
+	assert.Equal(t, []string{"peer-1"}, ephemeralManager.disconnected)
+}
+
+func TestOnPeerDisconnected_NewerSessionOwnsPeer(t *testing.T) {
+	ctx := context.Background()
+	ephemeralManager := &recordingEphemeralManager{}
+	updateManager := update_channel.NewPeersUpdateManager(nil)
+	c := Controller{repo: NewMockRepository(gomock.NewController(t)), peersUpdateManager: updateManager, EphemeralPeersManager: ephemeralManager}
+
+	stale := updateManager.CreateChannel(ctx, "peer-1")
+	current := updateManager.CreateChannel(ctx, "peer-1")
+
+	require.False(t, c.OnPeerDisconnected(ctx, "account-1", "peer-1", stale))
+	require.True(t, updateManager.HasChannel("peer-1"))
+	updateManager.SendUpdate(ctx, "peer-1", &network_map.UpdateMessage{})
+	select {
+	case _, open := <-current:
+		assert.True(t, open, "newer session channel must stay open")
+	default:
+		t.Fatal("newer session channel did not receive the update")
+	}
+	assert.Empty(t, ephemeralManager.disconnected, "a live peer must not be scheduled for ephemeral cleanup")
+}

management/internals/controllers/network_map/controller/controller_test.go

@@ -122,11 +122,10 @@ func TestGetValidatedPeerWithComponents_DeletedPeer(t *testing.T) {
 	}
 
 	mockrequestBuffer.EXPECT().GetAccountWithBackpressure(gomock.Any(), gomock.Any()).Return(&types.Account{}, nil)
-	peer, components, netmap, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
+	peer, components, posturechecks, dnsforwardPort, err := c.GetValidatedPeerWithComponents(context.TODO(), false, "test-account-id", &nbpeer.Peer{ID: "test-peer-id"})
 
 	assert.Nil(t, peer)
 	assert.Nil(t, components)
-	assert.Nil(t, netmap)
 	assert.Nil(t, posturechecks)
 	assert.Equal(t, int64(0), dnsforwardPort)
 	assert.NotNil(t, err)

management/internals/controllers/network_map/controller/repository.go

@@ -44,7 +44,7 @@ func (r *repository) GetAccountNetwork(ctx context.Context, accountID string) (*
 }
 
 func (r *repository) GetAccountPeers(ctx context.Context, accountID string) ([]*peer.Peer, error) {
-	return r.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	return r.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 }
 
 func (r *repository) GetAccountByPeerID(ctx context.Context, peerID string) (*types.Account, error) {

management/internals/controllers/network_map/controller/repository_mock.go

@@ -89,6 +89,21 @@ func (mr *MockRepositoryMockRecorder) GetAccountPeers(ctx, accountID any) *gomoc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockRepository)(nil).GetAccountPeers), ctx, accountID)
 }
 
+// GetAccountServices mocks base method.
+func (m *MockRepository) GetAccountServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountServices", ctx, accountID)
+	ret0, _ := ret[0].([]*service.Service)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountServices indicates an expected call of GetAccountServices.
+func (mr *MockRepositoryMockRecorder) GetAccountServices(ctx, accountID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountServices", reflect.TypeOf((*MockRepository)(nil).GetAccountServices), ctx, accountID)
+}
+
 // GetAccountZones mocks base method.
 func (m *MockRepository) GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error) {
 	m.ctrl.T.Helper()

management/internals/controllers/network_map/interface.go

@@ -24,7 +24,7 @@ type Controller interface {
 	UpdateAccountPeer(ctx context.Context, accountId string, peerId string) error
 	BufferUpdateAccountPeers(ctx context.Context, accountID string, reason types.UpdateReason) error
 	GetValidatedPeerWithMap(ctx context.Context, isRequiresApproval bool, accountID string, peerID string) (*types.NetworkMap, []*nmdata.PostureChecks, int64, error)
-	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
+	GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *nbpeer.Peer) (*nbpeer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error)
 	GetDNSDomain(settings *types.Settings) string
 	StartWarmup(context.Context)
 	GetNetworkMap(ctx context.Context, peerID string) (*types.NetworkMap, error)
@@ -35,7 +35,10 @@ type Controller interface {
 	OnPeersDeleted(ctx context.Context, accountID string, peerIDs []string, affectedPeerIDs []string) error
 	DisconnectPeers(ctx context.Context, accountId string, peerIDs []string)
 	OnPeerConnected(ctx context.Context, accountID string, peerID string) (chan *UpdateMessage, error)
-	OnPeerDisconnected(ctx context.Context, accountID string, peerID string)
+	// OnPeerDisconnected tears down the stream state of the peer's session, identified by its
+	// updates channel. It returns false and leaves everything untouched when a newer session
+	// owns the peer. A nil session is the newest session and tears down any registered channel.
+	OnPeerDisconnected(ctx context.Context, accountID string, peerID string, session chan *UpdateMessage) bool
 
 	TrackEphemeralPeer(ctx context.Context, peer *nbpeer.Peer)
 }

management/internals/controllers/network_map/interface_mock.go

@@ -127,16 +127,15 @@ func (mr *MockControllerMockRecorder) GetNetworkMap(ctx, peerID any) *gomock.Cal
 }
 
 // GetValidatedPeerWithComponents mocks base method.
-func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
+func (m *MockController) GetValidatedPeerWithComponents(ctx context.Context, isRequiresApproval bool, accountID string, p *peer.Peer) (*peer.Peer, *types.NetworkMapComponents, []*nmdata.PostureChecks, int64, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetValidatedPeerWithComponents", ctx, isRequiresApproval, accountID, p)
 	ret0, _ := ret[0].(*peer.Peer)
 	ret1, _ := ret[1].(*types.NetworkMapComponents)
-	ret2, _ := ret[2].(*types.NetworkMap)
-	ret3, _ := ret[3].([]*nmdata.PostureChecks)
-	ret4, _ := ret[4].(int64)
-	ret5, _ := ret[5].(error)
-	return ret0, ret1, ret2, ret3, ret4, ret5
+	ret2, _ := ret[2].([]*nmdata.PostureChecks)
+	ret3, _ := ret[3].(int64)
+	ret4, _ := ret[4].(error)
+	return ret0, ret1, ret2, ret3, ret4
 }
 
 // GetValidatedPeerWithComponents indicates an expected call of GetValidatedPeerWithComponents.
@@ -178,15 +177,17 @@ func (mr *MockControllerMockRecorder) OnPeerConnected(ctx, accountID, peerID any
 }
 
 // OnPeerDisconnected mocks base method.
-func (m *MockController) OnPeerDisconnected(ctx context.Context, accountID, peerID string) {
+func (m *MockController) OnPeerDisconnected(ctx context.Context, accountID, peerID string, session chan *UpdateMessage) bool {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "OnPeerDisconnected", ctx, accountID, peerID)
+	ret := m.ctrl.Call(m, "OnPeerDisconnected", ctx, accountID, peerID, session)
+	ret0, _ := ret[0].(bool)
+	return ret0
 }
 
 // OnPeerDisconnected indicates an expected call of OnPeerDisconnected.
-func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID any) *gomock.Call {
+func (mr *MockControllerMockRecorder) OnPeerDisconnected(ctx, accountID, peerID, session any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockController)(nil).OnPeerDisconnected), ctx, accountID, peerID)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPeerDisconnected", reflect.TypeOf((*MockController)(nil).OnPeerDisconnected), ctx, accountID, peerID, session)
 }
 
 // OnPeersAdded mocks base method.

management/internals/controllers/network_map/nmaptest/canonicalize.go

@@ -123,7 +123,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -353,16 +352,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""

management/internals/controllers/network_map/nmaptest/runner.go

@@ -243,7 +243,7 @@ func computeMode(t *testing.T, ctx context.Context, mode Mode, nmData *networkma
 	case ModeEnvelope:
 		components := nmData.GetPeerNetworkMapComponents(peerID, zone)
 		peerGroups := maps.Keys(nmData.GetPeerGroups(peerID))
-		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components, nil,
+		resp := mgmtgrpc.ToComponentSyncResponse(ctx, nil, nil, nil, peer, nil, nil, components,
 			dnsDomain, nil, nmData.AccountSettings, nil, peerGroups, dnsFwdPort, "")
 		res, err := networkmap.EnvelopeToNetworkMap(ctx, resp.NetworkMapEnvelope, peer.Key, dnsDomain, false)
 		require.NoError(t, err, "expand envelope")

management/internals/controllers/network_map/update_channel.go

@@ -6,6 +6,10 @@ type PeersUpdateManager interface {
 	SendUpdate(ctx context.Context, peerID string, update *UpdateMessage)
 	CreateChannel(ctx context.Context, peerID string) chan *UpdateMessage
 	CloseChannel(ctx context.Context, peerID string)
+	// CloseSessionChannel closes the peer's channel and returns true, unless a channel of
+	// another session is registered, in which case it returns false and closes nothing.
+	// A nil session is the newest session and closes any registered channel.
+	CloseSessionChannel(ctx context.Context, peerID string, session chan *UpdateMessage) bool
 	CountStreams() int
 	HasChannel(peerID string) bool
 	CloseChannels(ctx context.Context, peerIDs []string)

management/internals/controllers/network_map/update_channel/updatechannel.go

@@ -133,6 +133,30 @@ func (p *PeersUpdateManager) CloseChannel(ctx context.Context, peerID string) {
 	p.closeChannel(ctx, peerID)
 }
 
+// CloseSessionChannel closes the peer's updates channel only while it is still session's channel.
+// It returns false when a newer stream has registered a different channel, which the stale
+// session must leave to its new owner. A nil session belongs to a stream that failed before
+// registering its own channel; it is the newest session and closes any channel still registered.
+func (p *PeersUpdateManager) CloseSessionChannel(ctx context.Context, peerID string, session chan *network_map.UpdateMessage) bool {
+	start := time.Now()
+
+	p.channelsMux.Lock()
+	defer func() {
+		p.channelsMux.Unlock()
+		if p.metrics != nil {
+			p.metrics.UpdateChannelMetrics().CountCloseChannelDuration(time.Since(start))
+		}
+	}()
+
+	if channel, ok := p.peerChannels[peerID]; ok && session != nil && channel != session {
+		log.WithContext(ctx).Debugf("skipped closing updates channel: peer %s is owned by a newer session", peerID)
+		return false
+	}
+
+	p.closeChannel(ctx, peerID)
+	return true
+}
+
 // GetAllConnectedPeers returns a copy of the connected peers map
 func (p *PeersUpdateManager) GetAllConnectedPeers() map[string]struct{} {
 	start := time.Now()

management/internals/controllers/network_map/update_channel/updatechannel_test.go

@@ -5,6 +5,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -84,3 +87,55 @@ func TestCloseChannel(t *testing.T) {
 		t.Error("Error closing the channel")
 	}
 }
+
+func TestCloseSessionChannel(t *testing.T) {
+	ctx := context.Background()
+	const peer = "test-close-session"
+
+	t.Run("own channel is closed", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		session := peersUpdater.CreateChannel(ctx, peer)
+
+		require.True(t, peersUpdater.CloseSessionChannel(ctx, peer, session))
+		assert.False(t, peersUpdater.HasChannel(peer))
+		_, open := <-session
+		assert.False(t, open, "own channel must be closed")
+	})
+
+	t.Run("newer session channel is kept", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		stale := peersUpdater.CreateChannel(ctx, peer)
+		current := peersUpdater.CreateChannel(ctx, peer)
+
+		require.False(t, peersUpdater.CloseSessionChannel(ctx, peer, stale))
+		require.True(t, peersUpdater.HasChannel(peer))
+		assert.Equal(t, current, peersUpdater.peerChannels[peer])
+
+		peersUpdater.SendUpdate(ctx, peer, &network_map.UpdateMessage{})
+		select {
+		case _, open := <-current:
+			assert.True(t, open, "newer session channel must stay open")
+		default:
+			t.Fatal("newer session channel did not receive the update")
+		}
+	})
+
+	t.Run("no registered channel", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		session := peersUpdater.CreateChannel(ctx, peer)
+		peersUpdater.CloseChannel(ctx, peer)
+
+		assert.True(t, peersUpdater.CloseSessionChannel(ctx, peer, session))
+		assert.True(t, peersUpdater.CloseSessionChannel(ctx, peer, nil))
+	})
+
+	t.Run("nil session closes the registered channel", func(t *testing.T) {
+		peersUpdater := NewPeersUpdateManager(nil)
+		current := peersUpdater.CreateChannel(ctx, peer)
+
+		require.True(t, peersUpdater.CloseSessionChannel(ctx, peer, nil))
+		assert.False(t, peersUpdater.HasChannel(peer))
+		_, open := <-current
+		assert.False(t, open, "registered channel must be closed")
+	})
+}

management/internals/modules/agentnetwork/accesslog_cleanup_realstore_test.go

@@ -0,0 +1,76 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+)
+
+// TestCleanupAccessLogs_RealStore_DeletedAccount covers a deleted account's access logs.
+// The sweep is driven by settings rows, which go with the account, so without a fallback
+// those logs would never expire. They get the default retention instead. A live account
+// can delete its own settings row, so "no settings" must not be mistaken for "deleted":
+// that account's logs are left alone, as are those of an account that keeps logs forever.
+func TestCleanupAccessLogs_RealStore_DeletedAccount(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const (
+		deletedAccountID    = "acc-deleted"
+		keepAccountID       = "acc-keep-forever"
+		noSettingsAccountID = "acc-live-no-settings"
+	)
+	old := time.Now().UTC().AddDate(0, 0, -(types.DefaultAccessLogRetentionDays + 10))
+	recent := time.Now().UTC().AddDate(0, 0, -1)
+
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: keepAccountID}))
+	require.NoError(t, s.SaveAccount(ctx, &nbtypes.Account{Id: noSettingsAccountID}))
+
+	keepSettings := types.DefaultSettings(keepAccountID)
+	keepSettings.Domain = "keep.gw.example.com"
+	keepSettings.AccessLogRetentionDays = 0
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, keepSettings))
+
+	mkLog := func(id, accountID string, ts time.Time) {
+		t.Helper()
+		entry := &types.AgentNetworkAccessLog{
+			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts, StatusCode: 200, Model: "gpt-4o",
+		}
+		groups := []types.AgentNetworkAccessLogGroup{{LogID: id, GroupID: "grp-eng", AccountID: accountID}}
+		require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, entry, groups))
+	}
+	mkLog("deleted-old", deletedAccountID, old)
+	mkLog("deleted-recent", deletedAccountID, recent)
+	mkLog("keep-old", keepAccountID, old)
+	mkLog("no-settings-old", noSettingsAccountID, old)
+
+	m := &managerImpl{store: s}
+	m.cleanupAccessLogsOnce(ctx)
+
+	logIDs := func(accountID string) []string {
+		t.Helper()
+		logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID,
+			types.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50})
+		require.NoError(t, err)
+		ids := make([]string, 0, len(logs))
+		for _, l := range logs {
+			ids = append(ids, l.ID)
+		}
+		return ids
+	}
+	assert.Equal(t, []string{"deleted-recent"}, logIDs(deletedAccountID),
+		"a deleted account should have logs past the default retention swept")
+	assert.Equal(t, []string{"keep-old"}, logIDs(keepAccountID),
+		"an account with retention disabled should keep its old logs")
+	assert.Equal(t, []string{"no-settings-old"}, logIDs(noSettingsAccountID),
+		"a live account without a settings row should keep its old logs")
+}

management/internals/modules/agentnetwork/manager.go

@@ -80,6 +80,9 @@ type Manager interface {
 	ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error)
 	GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error)
 	StartAccessLogCleanup(ctx context.Context, cleanupIntervalHours int)
+	// RemoveAccountGateway drops the account's gateway mappings from the
+	// proxies. It runs as an account deletion hook.
+	RemoveAccountGateway(ctx context.Context, accountID string) error
 	RecordConsumption(ctx context.Context, accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds, tokensIn, tokensOut int64, costUSD float64) error
 	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
 	RecordUsage(ctx context.Context, in RecordUsageInput) error
@@ -1350,8 +1353,8 @@ func (m *managerImpl) scopeFilterToCaller(ctx context.Context, accountID, userID
 
 // StartAccessLogCleanup launches a background sweep that periodically deletes
 // each account's agent-network access-log rows older than that account's
-// AccessLogRetentionDays. Usage records are never swept. A non-positive
-// interval defaults to 24h.
+// AccessLogRetentionDays, and the consumption counters of deleted accounts.
+// Usage records are never swept. A non-positive interval defaults to 24h.
 func (m *managerImpl) StartAccessLogCleanup(ctx context.Context, cleanupIntervalHours int) {
 	if cleanupIntervalHours <= 0 {
 		cleanupIntervalHours = 24
@@ -1362,21 +1365,40 @@ func (m *managerImpl) StartAccessLogCleanup(ctx context.Context, cleanupInterval
 		ticker := time.NewTicker(interval)
 		defer ticker.Stop()
 
-		m.cleanupAccessLogsOnce(ctx) // run once on startup
+		m.cleanupOnce(ctx) // run once on startup
 		for {
 			select {
 			case <-ctx.Done():
 				return
 			case <-ticker.C:
-				m.cleanupAccessLogsOnce(ctx)
+				m.cleanupOnce(ctx)
 			}
 		}
 	}()
 }
 
+func (m *managerImpl) cleanupOnce(ctx context.Context) {
+	m.cleanupAccessLogsOnce(ctx)
+	m.cleanupDeletedAccountConsumption(ctx)
+}
+
+// cleanupDeletedAccountConsumption deletes the consumption counters of accounts
+// that no longer exist. Best-effort: a failure is logged and retried next sweep.
+func (m *managerImpl) cleanupDeletedAccountConsumption(ctx context.Context) {
+	deleted, err := m.store.DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx)
+	if err != nil {
+		log.WithContext(ctx).Warnf("agent-network consumption cleanup: %v", err)
+		return
+	}
+	if deleted > 0 {
+		log.WithContext(ctx).Infof("agent-network consumption cleanup: deleted %d counters of deleted accounts", deleted)
+	}
+}
+
 // cleanupAccessLogsOnce sweeps every account's expired access-log rows against
-// its configured retention. Best-effort: a per-account failure is logged and
-// the sweep continues.
+// its configured retention. Deleted accounts, whose settings rows went with
+// them, get the default retention. Best-effort: a per-account failure is
+// logged and the sweep continues.
 func (m *managerImpl) cleanupAccessLogsOnce(ctx context.Context) {
 	settings, err := m.store.GetAllAgentNetworkSettings(ctx, store.LockingStrengthNone)
 	if err != nil {
@@ -1384,18 +1406,31 @@ func (m *managerImpl) cleanupAccessLogsOnce(ctx context.Context) {
 		return
 	}
 	for _, s := range settings {
-		if s.AccessLogRetentionDays <= 0 {
-			continue // keep indefinitely
-		}
-		cutoff := time.Now().UTC().AddDate(0, 0, -s.AccessLogRetentionDays)
-		deleted, err := m.store.DeleteOldAgentNetworkAccessLogs(ctx, s.AccountID, cutoff)
-		if err != nil {
-			log.WithContext(ctx).Warnf("agent-network access-log cleanup for account %s: %v", s.AccountID, err)
-			continue
-		}
-		if deleted > 0 {
-			log.WithContext(ctx).Infof("agent-network access-log cleanup: deleted %d rows for account %s (retention %d days)", deleted, s.AccountID, s.AccessLogRetentionDays)
-		}
+		m.cleanupAccountAccessLogs(ctx, s.AccountID, s.AccessLogRetentionDays)
+	}
+
+	deleted, err := m.store.GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx)
+	if err != nil {
+		log.WithContext(ctx).Errorf("agent-network access-log cleanup: list deleted accounts: %v", err)
+		return
+	}
+	for _, accountID := range deleted {
+		m.cleanupAccountAccessLogs(ctx, accountID, types.DefaultAccessLogRetentionDays)
+	}
+}
+
+func (m *managerImpl) cleanupAccountAccessLogs(ctx context.Context, accountID string, retentionDays int) {
+	if retentionDays <= 0 {
+		return // keep indefinitely
+	}
+	cutoff := time.Now().UTC().AddDate(0, 0, -retentionDays)
+	deleted, err := m.store.DeleteOldAgentNetworkAccessLogs(ctx, accountID, cutoff)
+	if err != nil {
+		log.WithContext(ctx).Warnf("agent-network access-log cleanup for account %s: %v", accountID, err)
+		return
+	}
+	if deleted > 0 {
+		log.WithContext(ctx).Infof("agent-network access-log cleanup: deleted %d rows for account %s (retention %d days)", deleted, accountID, retentionDays)
 	}
 }
 
@@ -1545,6 +1580,8 @@ func (*mockManager) GetUsageOverview(_ context.Context, _, _ string, _ types.Age
 
 func (*mockManager) StartAccessLogCleanup(_ context.Context, _ int) {}
 
+func (*mockManager) RemoveAccountGateway(_ context.Context, _ string) error { return nil }
+
 func (*mockManager) RecordConsumption(_ context.Context, _ string, _ types.ConsumptionDimension, _ string, _, _, _ int64, _ float64) error {
 	return nil
 }

management/internals/modules/agentnetwork/reconcile.go

@@ -2,8 +2,10 @@ package agentnetwork
 
 import (
 	"context"
+	"fmt"
 
 	log "github.com/sirupsen/logrus"
+	goproto "google.golang.org/protobuf/proto"
 
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/types"
@@ -81,18 +83,66 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 	m.reconcileMu.Unlock()
 
-	for _, entry := range creates {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	m.sendMappings(ctx, accountID, creates, proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED)
+	m.sendMappings(ctx, accountID, updates, proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED)
+	m.sendMappings(ctx, accountID, deletes, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED)
+}
+
+// sendMappings sends each entry as updateType. It sends a copy: the entries'
+// mappings are shared with reconcileCache, which another reconcile or
+// RemoveAccountGateway may be reading, so they are never written.
+func (m *managerImpl) sendMappings(ctx context.Context, accountID string, entries []syntheticMapping, updateType proto.ProxyMappingUpdateType) {
+	for _, entry := range entries {
+		update := goproto.Clone(entry.mapping).(*proto.ProxyMapping)
+		update.Type = updateType
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, update, entry.cluster)
 	}
-	for _, entry := range updates {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+}
+
+// RemoveAccountGateway tells the proxies to drop every mapping of the account's
+// gateway, so a deleted account's proxy config, provider API keys included, does
+// not linger in proxy memory until the next resync. It is an account deletion
+// hook: it runs before the account's data is removed, the last point at which
+// the mappings can be synthesised from the store. The cache alone would miss
+// them, since it is per instance and empty after a restart. If the deletion
+// then fails, the gateway stays down until the account's next change reconciles
+// it back.
+func (m *managerImpl) RemoveAccountGateway(ctx context.Context, accountID string) error {
+	if m.proxyController == nil {
+		return nil
 	}
-	for _, entry := range deletes {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+
+	services, err := SynthesizeServices(ctx, m.store, accountID)
+	if err != nil {
+		return fmt.Errorf("synthesise agent network services: %w", err)
 	}
+	oidcCfg := m.proxyController.GetOIDCValidationConfig()
+	removed := make(map[string]syntheticMapping, len(services))
+	for _, svc := range services {
+		if svc == nil || svc.ID == "" {
+			continue
+		}
+		removed[svc.ID] = syntheticMapping{
+			mapping: svc.ToProtoMapping(rpservice.Delete, "", oidcCfg),
+			cluster: svc.ProxyCluster,
+		}
+	}
+
+	m.reconcileMu.Lock()
+	for id, entry := range m.reconcileCache[accountID] {
+		if _, ok := removed[id]; !ok {
+			removed[id] = entry
+		}
+	}
+	delete(m.reconcileCache, accountID)
+	m.reconcileMu.Unlock()
+
+	entries := make([]syntheticMapping, 0, len(removed))
+	for _, entry := range removed {
+		entries = append(entries, entry)
+	}
+	m.sendMappings(ctx, accountID, entries, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED)
+	return nil
 }
 
 // diffMappings classifies the previous→current transition for a single

management/internals/modules/agentnetwork/reconcile_test.go

@@ -2,6 +2,8 @@ package agentnetwork
 
 import (
 	"context"
+	"sync"
+	"sync/atomic"
 	"testing"
 
 	"go.uber.org/mock/gomock"
@@ -12,6 +14,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 func newReconcileMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *store.MockStore, *proxy.MockController) {
@@ -287,3 +290,154 @@ func TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster(t *testing.T) {
 		assert.Equal(t, "brave-otter.gateway.example.com", deletes[0].cluster)
 	}
 }
+
+// TestRemoveAccountGateway_EmitsRemovedFromStore — account deletion runs on an
+// instance that may never have reconciled the account, so its cache is empty.
+// The mappings are synthesised from the store, still intact before the delete,
+// and each is sent as REMOVED to the cluster that serves it.
+func TestRemoveAccountGateway_EmitsRemovedFromStore(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	expectReconcileSynthInputs(mockStore, ctx, []*types.Provider{provider}, []*types.Policy{policy}, []*types.Guardrail{})
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+
+	var sent []*proto.ProxyMapping
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), "eu.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			sent = append(sent, m)
+		})
+
+	require.NoError(t, mgr.RemoveAccountGateway(ctx, "acct-1"))
+
+	require.Len(t, sent, 1, "the account's one gateway mapping must be removed")
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED, sent[0].Type, "the update must be a removal")
+	assert.Equal(t, "agent-net-svc-acct-1", sent[0].Id, "the removal must name the account's gateway service")
+}
+
+// TestRemoveAccountGateway_AlsoRemovesCachedMappings — a mapping this instance
+// last sent but the store no longer synthesises (here, one on another cluster)
+// is removed too, and the account's cache entry is cleared.
+func TestRemoveAccountGateway_AlsoRemovesCachedMappings(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	mgr.reconcileCache["acct-1"] = map[string]syntheticMapping{
+		"stale-svc": {mapping: &proto.ProxyMapping{Id: "stale-svc"}, cluster: "us.proxy.netbird.io"},
+	}
+
+	// Settings but no providers: the store synthesises nothing.
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").
+		Return(newReconcileTestSettings(), nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").
+		Return([]*types.Provider{}, nil)
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+
+	var sent []*proto.ProxyMapping
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), "us.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			sent = append(sent, m)
+		})
+
+	require.NoError(t, mgr.RemoveAccountGateway(ctx, "acct-1"))
+
+	require.Len(t, sent, 1, "the cached mapping must be removed from its own cluster")
+	assert.Equal(t, "stale-svc", sent[0].Id)
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED, sent[0].Type)
+	mgr.reconcileMu.Lock()
+	_, present := mgr.reconcileCache["acct-1"]
+	mgr.reconcileMu.Unlock()
+	assert.False(t, present, "the deleted account's cache entry must be cleared")
+}
+
+// TestRemoveAccountGateway_SynthFailureAbortsDeletion — if the mappings cannot
+// be read, nothing is sent and the error is returned, which as an account
+// deletion hook keeps the account rather than leaving its gateway running.
+func TestRemoveAccountGateway_SynthFailureAbortsDeletion(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, _ := newReconcileMgr(t, ctrl)
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").
+		Return(nil, status.Errorf(status.Internal, "store unavailable"))
+
+	assert.Error(t, mgr.RemoveAccountGateway(ctx, "acct-1"), "a failed synthesis must fail the hook")
+}
+
+func TestRemoveAccountGateway_NilProxyController_NoOp(t *testing.T) {
+	mgr := &managerImpl{reconcileCache: make(map[string]map[string]syntheticMapping)}
+	// Must not panic and must not query the store.
+	assert.NoError(t, mgr.RemoveAccountGateway(context.Background(), "acct-1"))
+}
+
+// TestReconcile_ConcurrentWithGatewayChanges — while an account's gateway
+// flaps (its policy is removed and re-added between reads), concurrent
+// reconciles and RemoveAccountGateway share the cached mappings: one caches a
+// mapping and sends it, another finds it gone and sends its removal. Run under
+// -race: neither path may write a cached mapping, only copies of it.
+func TestReconcile_ConcurrentWithGatewayChanges(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	// gomock serialises every call on the controller's mutex, which would give
+	// the race detector the ordering the code under test lacks. The sends go
+	// through a fake that takes no lock.
+	mgr.proxyController = unsyncedSender{MockController: mockProxy}
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	var reads atomic.Int64
+	mockStore.EXPECT().GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").Return(newReconcileTestSettings(), nil).AnyTimes()
+	mockStore.EXPECT().GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Provider{provider}, nil).AnyTimes()
+	mockStore.EXPECT().GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, "acct-1").
+		DoAndReturn(func(context.Context, store.LockingStrength, string) ([]*types.Policy, error) {
+			if reads.Add(1)%2 == 0 {
+				return []*types.Policy{}, nil
+			}
+			return []*types.Policy{policy}, nil
+		}).AnyTimes()
+	mockStore.EXPECT().GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Guardrail{}, nil).AnyTimes()
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func(remove bool) {
+			defer wg.Done()
+			for j := 0; j < 50; j++ {
+				if remove && j%10 == 0 {
+					_ = mgr.RemoveAccountGateway(ctx, "acct-1")
+					continue
+				}
+				mgr.reconcile(ctx, "acct-1")
+			}
+		}(i == 0)
+	}
+	wg.Wait()
+}
+
+// unsyncedSender answers the calls reconcile makes on every pass without any
+// locking, so concurrent callers are not ordered by the fake itself.
+type unsyncedSender struct {
+	*proxy.MockController
+}
+
+func (unsyncedSender) GetOIDCValidationConfig() proxy.OIDCValidationConfig {
+	return proxy.OIDCValidationConfig{}
+}
+
+func (unsyncedSender) SendServiceUpdateToCluster(context.Context, string, *proto.ProxyMapping, string) {}

management/internals/modules/peers/manager.go

@@ -97,7 +97,7 @@ func (m *managerImpl) GetAllPeers(ctx context.Context, accountID, userID string)
 		return m.store.GetUserPeers(ctx, store.LockingStrengthNone, accountID, userID)
 	}
 
-	return m.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	return m.store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 }
 
 func (m *managerImpl) GetPeerAccountID(ctx context.Context, peerID string) (string, error) {

management/internals/modules/reverseproxy/accesslogs/manager/manager.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
@@ -18,14 +19,16 @@ import (
 )
 
 type managerImpl struct {
+	repo               accesslogs.Repository
 	store              store.Store
 	permissionsManager permissions.Manager
 	geo                geolocation.Geolocation
 	cleanupCancel      context.CancelFunc
 }
 
-func NewManager(store store.Store, permissionsManager permissions.Manager, geo geolocation.Geolocation) accesslogs.Manager {
+func NewManager(repo accesslogs.Repository, store store.Store, permissionsManager permissions.Manager, geo geolocation.Geolocation) accesslogs.Manager {
 	return &managerImpl{
+		repo:               repo,
 		store:              store,
 		permissionsManager: permissionsManager,
 		geo:                geo,
@@ -54,7 +57,7 @@ func (m *managerImpl) SaveAccessLog(ctx context.Context, logEntry *accesslogs.Ac
 		}
 	}
 
-	if err := m.store.CreateAccessLog(ctx, logEntry); err != nil {
+	if err := m.repo.Create(ctx, logEntry); err != nil {
 		log.WithContext(ctx).WithFields(log.Fields{
 			"service_id": logEntry.ServiceID,
 			"method":     logEntry.Method,
@@ -82,7 +85,7 @@ func (m *managerImpl) GetAllAccessLogs(ctx context.Context, accountID, userID st
 		log.WithContext(ctx).Warnf("failed to resolve user filters: %v", err)
 	}
 
-	logs, totalCount, err := m.store.GetAccountAccessLogs(ctx, store.LockingStrengthNone, accountID, *filter)
+	logs, totalCount, err := m.repo.ListByAccount(ctx, db.LockingStrengthNone, accountID, *filter)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -98,7 +101,7 @@ func (m *managerImpl) CleanupOldAccessLogs(ctx context.Context, retentionDays in
 	}
 
 	cutoffTime := time.Now().AddDate(0, 0, -retentionDays)
-	deletedCount, err := m.store.DeleteOldAccessLogs(ctx, cutoffTime)
+	deletedCount, err := m.repo.DeleteOlderThan(ctx, cutoffTime)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to cleanup old access logs: %v", err)
 		return 0, err

management/internals/modules/reverseproxy/accesslogs/manager/manager_test.go

@@ -5,27 +5,27 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
-	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 )
 
 func TestCleanupOldAccessLogs(t *testing.T) {
 	tests := []struct {
 		name          string
 		retentionDays int
-		setupMock     func(*store.MockStore)
+		setupMock     func(*accesslogs.MockRepository)
 		expectedCount int64
 		expectedError bool
 	}{
 		{
 			name:          "cleanup logs older than retention period",
 			retentionDays: 30,
-			setupMock: func(mockStore *store.MockStore) {
-				mockStore.EXPECT().
-					DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				mockRepo.EXPECT().
+					DeleteOlderThan(gomock.Any(), gomock.Any()).
 					DoAndReturn(func(ctx context.Context, olderThan time.Time) (int64, error) {
 						expectedCutoff := time.Now().AddDate(0, 0, -30)
 						timeDiff := olderThan.Sub(expectedCutoff)
@@ -41,9 +41,9 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 		{
 			name:          "no logs to cleanup",
 			retentionDays: 30,
-			setupMock: func(mockStore *store.MockStore) {
-				mockStore.EXPECT().
-					DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				mockRepo.EXPECT().
+					DeleteOlderThan(gomock.Any(), gomock.Any()).
 					Return(int64(0), nil)
 			},
 			expectedCount: 0,
@@ -52,8 +52,8 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 		{
 			name:          "zero retention days skips cleanup",
 			retentionDays: 0,
-			setupMock: func(mockStore *store.MockStore) {
-				// No expectations - DeleteOldAccessLogs should not be called
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				// No expectations - DeleteOlderThan should not be called
 			},
 			expectedCount: 0,
 			expectedError: false,
@@ -61,8 +61,8 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 		{
 			name:          "negative retention days skips cleanup",
 			retentionDays: -10,
-			setupMock: func(mockStore *store.MockStore) {
-				// No expectations - DeleteOldAccessLogs should not be called
+			setupMock: func(mockRepo *accesslogs.MockRepository) {
+				// No expectations - DeleteOlderThan should not be called
 			},
 			expectedCount: 0,
 			expectedError: false,
@@ -74,11 +74,11 @@ func TestCleanupOldAccessLogs(t *testing.T) {
 			ctrl := gomock.NewController(t)
 			defer ctrl.Finish()
 
-			mockStore := store.NewMockStore(ctrl)
-			tt.setupMock(mockStore)
+			mockRepo := accesslogs.NewMockRepository(ctrl)
+			tt.setupMock(mockRepo)
 
 			manager := &managerImpl{
-				store: mockStore,
+				repo: mockRepo,
 			}
 
 			ctx := context.Background()
@@ -98,10 +98,10 @@ func TestCleanupWithExactBoundary(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockStore := store.NewMockStore(ctrl)
+	mockRepo := accesslogs.NewMockRepository(ctrl)
 
-	mockStore.EXPECT().
-		DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+	mockRepo.EXPECT().
+		DeleteOlderThan(gomock.Any(), gomock.Any()).
 		DoAndReturn(func(ctx context.Context, olderThan time.Time) (int64, error) {
 			expectedCutoff := time.Now().AddDate(0, 0, -30)
 			timeDiff := olderThan.Sub(expectedCutoff)
@@ -110,7 +110,7 @@ func TestCleanupWithExactBoundary(t *testing.T) {
 		})
 
 	manager := &managerImpl{
-		store: mockStore,
+		repo: mockRepo,
 	}
 
 	ctx := context.Background()
@@ -125,11 +125,11 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 		// No expectations - cleanup should not run
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -139,22 +139,22 @@ func TestStartPeriodicCleanup(t *testing.T) {
 
 		time.Sleep(100 * time.Millisecond)
 
-		// If DeleteOldAccessLogs was called, the test will fail due to unexpected call
+		// If DeleteOlderThan was called, the test will fail due to unexpected call
 	})
 
 	t.Run("periodic cleanup runs immediately on start", func(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(2), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -171,15 +171,15 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(1), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -198,15 +198,15 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(0), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -223,15 +223,15 @@ func TestStartPeriodicCleanup(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		defer ctrl.Finish()
 
-		mockStore := store.NewMockStore(ctrl)
+		mockRepo := accesslogs.NewMockRepository(ctrl)
 
-		mockStore.EXPECT().
-			DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+		mockRepo.EXPECT().
+			DeleteOlderThan(gomock.Any(), gomock.Any()).
 			Return(int64(3), nil).
 			Times(1)
 
 		manager := &managerImpl{
-			store: mockStore,
+			repo: mockRepo,
 		}
 
 		ctx, cancel := context.WithCancel(context.Background())
@@ -249,15 +249,15 @@ func TestStopPeriodicCleanup(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockStore := store.NewMockStore(ctrl)
+	mockRepo := accesslogs.NewMockRepository(ctrl)
 
-	mockStore.EXPECT().
-		DeleteOldAccessLogs(gomock.Any(), gomock.Any()).
+	mockRepo.EXPECT().
+		DeleteOlderThan(gomock.Any(), gomock.Any()).
 		Return(int64(1), nil).
 		Times(1)
 
 	manager := &managerImpl{
-		store: mockStore,
+		repo: mockRepo,
 	}
 
 	ctx := context.Background()

management/internals/modules/reverseproxy/accesslogs/manager/repository.go

@@ -1,4 +1,4 @@
-package store
+package manager
 
 import (
 	"context"
@@ -10,91 +10,78 @@ import (
 	"gorm.io/gorm/clause"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
-// CreateAccessLog creates a new access log entry in the database
-func (s *SqlStore) CreateAccessLog(ctx context.Context, logEntry *accesslogs.AccessLogEntry) error {
-	result := s.db.Create(logEntry)
-	if result.Error != nil {
+type sqlRepository struct {
+	conn *db.Conn
+	db   *gorm.DB
+}
+
+// NewRepository returns the access log repository backed by conn.
+func NewRepository(conn *db.Conn) accesslogs.Repository {
+	return &sqlRepository{conn: conn, db: conn.DB(nil)}
+}
+
+func (r *sqlRepository) WithTx(tx *db.Tx) accesslogs.Repository {
+	return &sqlRepository{conn: r.conn, db: r.conn.DB(tx)}
+}
+
+func (r *sqlRepository) Create(ctx context.Context, entry *accesslogs.AccessLogEntry) error {
+	if err := r.db.Create(entry).Error; err != nil {
 		log.WithContext(ctx).WithFields(log.Fields{
-			"service_id": logEntry.ServiceID,
-			"method":     logEntry.Method,
-			"host":       logEntry.Host,
-			"path":       logEntry.Path,
-		}).Errorf("failed to create access log entry in store: %v", result.Error)
+			"service_id": entry.ServiceID,
+			"method":     entry.Method,
+			"host":       entry.Host,
+			"path":       entry.Path,
+		}).Errorf("failed to create access log entry in store: %v", err)
 		return status.Errorf(status.Internal, "failed to create access log entry in store")
 	}
 	return nil
 }
 
-// GetAccountAccessLogs retrieves access logs for a given account with pagination and filtering
-func (s *SqlStore) GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
-	var logs []*accesslogs.AccessLogEntry
+// ListByAccount returns one page of an account's access logs together with the
+// total number of entries matching the filter.
+func (r *sqlRepository) ListByAccount(ctx context.Context, lockStrength db.LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
 	var totalCount int64
-
-	baseQuery := s.db.
-		Model(&accesslogs.AccessLogEntry{}).
-		Where(accountIDCondition, accountID)
-
-	baseQuery = s.applyAccessLogFilters(baseQuery, filter)
-
-	if err := baseQuery.Count(&totalCount).Error; err != nil {
+	countQuery := applyFilters(r.db.Model(&accesslogs.AccessLogEntry{}).Where("account_id = ?", accountID), filter)
+	if err := countQuery.Count(&totalCount).Error; err != nil {
 		log.WithContext(ctx).Errorf("failed to count access logs: %v", err)
 		return nil, 0, status.Errorf(status.Internal, "failed to count access logs")
 	}
 
-	query := s.db.
-		Where(accountIDCondition, accountID)
-
-	query = s.applyAccessLogFilters(query, filter)
-
-	sortColumns := filter.GetSortColumn()
+	query := applyFilters(r.db.Where("account_id = ?", accountID), filter)
 	sortOrder := strings.ToUpper(filter.GetSortOrder())
-
-	var orderClauses []string
-	for _, col := range strings.Split(sortColumns, ",") {
-		col = strings.TrimSpace(col)
-		if col != "" {
-			orderClauses = append(orderClauses, col+" "+sortOrder)
+	for _, column := range strings.Split(filter.GetSortColumn(), ",") {
+		if column = strings.TrimSpace(column); column != "" {
+			query = query.Order(column + " " + sortOrder)
 		}
 	}
-	orderClause := strings.Join(orderClauses, ", ")
-
-	query = query.
-		Order(orderClause).
-		Limit(filter.GetLimit()).
-		Offset(filter.GetOffset())
-
-	if lockStrength != LockingStrengthNone {
+	query = query.Limit(filter.GetLimit()).Offset(filter.GetOffset())
+	if lockStrength != db.LockingStrengthNone {
 		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
 	}
 
-	result := query.Find(&logs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get access logs from store: %v", result.Error)
+	var logs []*accesslogs.AccessLogEntry
+	if err := query.Find(&logs).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get access logs from store: %v", err)
 		return nil, 0, status.Errorf(status.Internal, "failed to get access logs from store")
 	}
 
 	return logs, totalCount, nil
 }
 
-// DeleteOldAccessLogs deletes all access logs older than the specified time
-func (s *SqlStore) DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error) {
-	result := s.db.
-		Where("timestamp < ?", olderThan).
-		Delete(&accesslogs.AccessLogEntry{})
-
+func (r *sqlRepository) DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error) {
+	result := r.db.Where("timestamp < ?", olderThan).Delete(&accesslogs.AccessLogEntry{})
 	if result.Error != nil {
 		log.WithContext(ctx).Errorf("failed to delete old access logs: %v", result.Error)
 		return 0, status.Errorf(status.Internal, "failed to delete old access logs")
 	}
-
 	return result.RowsAffected, nil
 }
 
-// applyAccessLogFilters applies filter conditions to the query
-func (s *SqlStore) applyAccessLogFilters(query *gorm.DB, filter accesslogs.AccessLogFilter) *gorm.DB {
+func applyFilters(query *gorm.DB, filter accesslogs.AccessLogFilter) *gorm.DB {
 	if filter.Search != nil {
 		searchPattern := "%" + *filter.Search + "%"
 		query = query.Where(
@@ -112,7 +99,6 @@ func (s *SqlStore) applyAccessLogFilters(query *gorm.DB, filter accesslogs.Acces
 	}
 
 	if filter.Path != nil {
-		// Support LIKE pattern for path filtering
 		query = query.Where("path LIKE ?", "%"+*filter.Path+"%")
 	}
 
@@ -127,9 +113,9 @@ func (s *SqlStore) applyAccessLogFilters(query *gorm.DB, filter accesslogs.Acces
 	if filter.Status != nil {
 		switch *filter.Status {
 		case "success":
-			query = query.Where("status_code >= ? AND status_code < ?", 200, 400)
+			query = query.Where("(status_code >= ? AND status_code < ?)", 200, 400)
 		case "failed":
-			query = query.Where("status_code < ? OR status_code >= ?", 200, 400)
+			query = query.Where("((status_code >= ? AND status_code < ?) OR status_code >= ?)", 100, 200, 400)
 		}
 	}
 

management/internals/modules/reverseproxy/accesslogs/manager/repository_test.go

@@ -0,0 +1,125 @@
+package manager
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+	"github.com/netbirdio/netbird/management/internals/shared/db/dbtest"
+)
+
+func newTestRepository(t *testing.T) (accesslogs.Repository, *db.Conn) {
+	conn := dbtest.NewConn(t, &accesslogs.AccessLogEntry{})
+	return NewRepository(conn), conn
+}
+
+func newEntry(id, accountID, method string, age time.Duration) *accesslogs.AccessLogEntry {
+	return &accesslogs.AccessLogEntry{
+		ID:         id,
+		AccountID:  accountID,
+		Method:     method,
+		Host:       "app.example.com",
+		Path:       "/",
+		StatusCode: 200,
+		Timestamp:  time.Now().Add(-age),
+	}
+}
+
+func TestSqlRepository_ListByAccount(t *testing.T) {
+	repo, _ := newTestRepository(t)
+	ctx := context.Background()
+	for _, entry := range []*accesslogs.AccessLogEntry{
+		newEntry("a1", "acc-a", "GET", 3*time.Hour),
+		newEntry("a2", "acc-a", "POST", 2*time.Hour),
+		newEntry("a3", "acc-a", "GET", time.Hour),
+		newEntry("b1", "acc-b", "GET", time.Hour),
+	} {
+		require.NoError(t, repo.Create(ctx, entry))
+	}
+
+	logs, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc-a", accesslogs.AccessLogFilter{Page: 1, PageSize: 2})
+	require.NoError(t, err)
+	assert.EqualValues(t, 3, total)
+	require.Len(t, logs, 2)
+	assert.Equal(t, "a3", logs[0].ID)
+	assert.Equal(t, "a2", logs[1].ID)
+
+	method := "GET"
+	logs, total, err = repo.ListByAccount(ctx, db.LockingStrengthNone, "acc-a", accesslogs.AccessLogFilter{Page: 1, PageSize: 10, Method: &method, SortOrder: "asc"})
+	require.NoError(t, err)
+	assert.EqualValues(t, 2, total)
+	require.Len(t, logs, 2)
+	assert.Equal(t, "a1", logs[0].ID)
+	assert.Equal(t, "a3", logs[1].ID)
+}
+
+func TestSqlRepository_DeleteOlderThan(t *testing.T) {
+	repo, _ := newTestRepository(t)
+	ctx := context.Background()
+	require.NoError(t, repo.Create(ctx, newEntry("old", "acc", "GET", 48*time.Hour)))
+	require.NoError(t, repo.Create(ctx, newEntry("new", "acc", "GET", time.Hour)))
+
+	deleted, err := repo.DeleteOlderThan(ctx, time.Now().Add(-24*time.Hour))
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, deleted)
+
+	logs, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, total)
+	require.Len(t, logs, 1)
+	assert.Equal(t, "new", logs[0].ID)
+}
+
+func TestSqlRepository_CreateInsideTransactionRollsBack(t *testing.T) {
+	repo, conn := newTestRepository(t)
+	ctx := context.Background()
+	failure := errors.New("abort")
+
+	err := conn.RunInTx(ctx, func(tx *db.Tx) error {
+		txRepo := repo.WithTx(tx)
+		require.NoError(t, txRepo.Create(ctx, newEntry("tx", "acc", "GET", 0)))
+		_, total, err := txRepo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10})
+		require.NoError(t, err)
+		assert.EqualValues(t, 1, total)
+		return failure
+	})
+	require.ErrorIs(t, err, failure)
+
+	_, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10})
+	require.NoError(t, err)
+	assert.Zero(t, total)
+}
+
+func TestSqlRepository_ListByAccount_StatusFilter(t *testing.T) {
+	repo, _ := newTestRepository(t)
+	ctx := context.Background()
+	statusCodes := map[string]int{"l4": 0, "info": 101, "ok": 200, "notfound": 404}
+	for id, code := range statusCodes {
+		entry := newEntry(id, "acc", "GET", time.Hour)
+		entry.StatusCode = code
+		require.NoError(t, repo.Create(ctx, entry))
+	}
+	foreign := newEntry("foreign", "other", "GET", time.Hour)
+	foreign.StatusCode = 500
+	require.NoError(t, repo.Create(ctx, foreign))
+
+	listIDs := func(status string) []string {
+		logs, total, err := repo.ListByAccount(ctx, db.LockingStrengthNone, "acc", accesslogs.AccessLogFilter{Page: 1, PageSize: 10, Status: &status, SortBy: "status_code", SortOrder: "asc"})
+		require.NoError(t, err)
+		require.EqualValues(t, len(logs), total)
+		ids := make([]string, 0, len(logs))
+		for _, entry := range logs {
+			ids = append(ids, entry.ID)
+		}
+		return ids
+	}
+
+	assert.Equal(t, []string{"info", "notfound"}, listIDs("failed"))
+	assert.Equal(t, []string{"ok"}, listIDs("success"))
+}

management/internals/modules/reverseproxy/accesslogs/repository.go

@@ -0,0 +1,18 @@
+package accesslogs
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+)
+
+//go:generate go tool mockgen -package accesslogs -destination=repository_mock.go -source=./repository.go -build_flags=-mod=mod
+
+// Repository persists reverse proxy access log entries.
+type Repository interface {
+	WithTx(tx *db.Tx) Repository
+	Create(ctx context.Context, entry *AccessLogEntry) error
+	ListByAccount(ctx context.Context, lockStrength db.LockingStrength, accountID string, filter AccessLogFilter) ([]*AccessLogEntry, int64, error)
+	DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error)
+}

management/internals/modules/reverseproxy/accesslogs/repository_mock.go

@@ -0,0 +1,102 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./repository.go
+//
+// Generated by this command:
+//
+//	mockgen -package accesslogs -destination=repository_mock.go -source=./repository.go -build_flags=-mod=mod
+//
+
+// Package accesslogs is a generated GoMock package.
+package accesslogs
+
+import (
+	context "context"
+	reflect "reflect"
+	time "time"
+
+	db "github.com/netbirdio/netbird/management/internals/shared/db"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockRepository is a mock of Repository interface.
+type MockRepository struct {
+	ctrl     *gomock.Controller
+	recorder *MockRepositoryMockRecorder
+	isgomock struct{}
+}
+
+// MockRepositoryMockRecorder is the mock recorder for MockRepository.
+type MockRepositoryMockRecorder struct {
+	mock *MockRepository
+}
+
+// NewMockRepository creates a new mock instance.
+func NewMockRepository(ctrl *gomock.Controller) *MockRepository {
+	mock := &MockRepository{ctrl: ctrl}
+	mock.recorder = &MockRepositoryMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockRepository) EXPECT() *MockRepositoryMockRecorder {
+	return m.recorder
+}
+
+// Create mocks base method.
+func (m *MockRepository) Create(ctx context.Context, entry *AccessLogEntry) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Create", ctx, entry)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Create indicates an expected call of Create.
+func (mr *MockRepositoryMockRecorder) Create(ctx, entry any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Create", reflect.TypeOf((*MockRepository)(nil).Create), ctx, entry)
+}
+
+// DeleteOlderThan mocks base method.
+func (m *MockRepository) DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteOlderThan", ctx, olderThan)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteOlderThan indicates an expected call of DeleteOlderThan.
+func (mr *MockRepositoryMockRecorder) DeleteOlderThan(ctx, olderThan any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOlderThan", reflect.TypeOf((*MockRepository)(nil).DeleteOlderThan), ctx, olderThan)
+}
+
+// ListByAccount mocks base method.
+func (m *MockRepository) ListByAccount(ctx context.Context, lockStrength db.LockingStrength, accountID string, filter AccessLogFilter) ([]*AccessLogEntry, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListByAccount", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*AccessLogEntry)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// ListByAccount indicates an expected call of ListByAccount.
+func (mr *MockRepositoryMockRecorder) ListByAccount(ctx, lockStrength, accountID, filter any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListByAccount", reflect.TypeOf((*MockRepository)(nil).ListByAccount), ctx, lockStrength, accountID, filter)
+}
+
+// WithTx mocks base method.
+func (m *MockRepository) WithTx(tx *db.Tx) Repository {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WithTx", tx)
+	ret0, _ := ret[0].(Repository)
+	return ret0
+}
+
+// WithTx indicates an expected call of WithTx.
+func (mr *MockRepositoryMockRecorder) WithTx(tx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WithTx", reflect.TypeOf((*MockRepository)(nil).WithTx), tx)
+}

management/internals/modules/reverseproxy/domain/manager/deletion_test.go

@@ -0,0 +1,80 @@
+package manager
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/activity"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/auth"
+)
+
+func TestDeleteDomain_ServiceDependencies(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		domainName  string
+		serviceHost string
+		accountID   string
+		enabled     bool
+		protected   bool
+	}{
+		{"exact", "example.com", "example.com", accountA, true, true},
+		{"subdomain", "example.com", "deep.app.example.com", accountA, true, true},
+		{"disabled", "example.com", "app.example.com", accountA, false, true},
+		// A service is authorized by its own account's registration, so another
+		// account's service under this namespace is not a dependency of it.
+		{"other account", "example.com", "app.example.com", accountB, true, false},
+		{"case and trailing dot", "example.com", "APP.EXAMPLE.COM.", accountA, true, true},
+		{"suffix boundary", "example.com", "notexample.com", accountA, true, false},
+		{"literal underscore", "a_b.example.com", "app.a_b.example.com", accountA, true, true},
+		{"underscore wildcard", "a_b.example.com", "app.axb.example.com", accountA, true, false},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			env := setupDomainTest(t)
+			events := captureDomainEvents(env)
+			d, err := env.store.CreateCustomDomain(ctx, accountA, tt.domainName, testCluster, true)
+			require.NoError(t, err)
+			svc := &rpservice.Service{
+				ID: "dependent", AccountID: tt.accountID, Domain: tt.serviceHost,
+				Enabled: tt.enabled, ProxyCluster: testCluster,
+			}
+			require.NoError(t, env.store.CreateService(ctx, svc))
+			router := mux.NewRouter()
+			RegisterEndpoints(router, env.manager)
+			deleteDomain := func() *httptest.ResponseRecorder {
+				req := httptest.NewRequest(http.MethodDelete, "/domains/"+d.ID, nil)
+				req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{AccountId: accountA, UserId: accountAUser})
+				response := httptest.NewRecorder()
+				router.ServeHTTP(response, req)
+				return response
+			}
+
+			response := deleteDomain()
+			if tt.protected {
+				require.Equal(t, http.StatusPreconditionFailed, response.Code, "dependent services must block deletion: %s", response.Body.String())
+				assert.NotContains(t, response.Body.String(), tt.accountID, "the error must not reveal the service's account")
+				assert.NotNil(t, storedDomain(t, env.store, accountA, d.Domain), "the namespace must remain reserved")
+				assert.Empty(t, events.get(), "rejected deletion must not emit DomainDeleted")
+				stored, err := env.store.GetServiceByID(ctx, nbstore.LockingStrengthNone, tt.accountID, svc.ID)
+				require.NoError(t, err)
+				assert.Equal(t, svc.Enabled, stored.Enabled, "rejected deletion must preserve the service")
+				require.NoError(t, env.store.DeleteService(ctx, tt.accountID, svc.ID))
+				response = deleteDomain()
+			}
+			require.Equal(t, http.StatusNoContent, response.Code, "deletion must succeed without dependencies: %s", response.Body.String())
+			assert.Nil(t, storedDomain(t, env.store, accountA, d.Domain), "the registration must be deleted")
+			captured := events.get()
+			require.Len(t, captured, 1, "only successful deletion may emit an event")
+			assert.Equal(t, activity.DomainDeleted, captured[0].Activity, "the event must describe the successful deletion")
+		})
+	}
+}

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -357,6 +357,26 @@ func (m Manager) DeriveClusterFromDomain(ctx context.Context, accountID, domain
 	return "", fmt.Errorf("domain %s does not match any available proxy cluster", domain)
 }
 
+// ValidateServiceDomain holds custom domain authorization through a service write transaction.
+func (m Manager) ValidateServiceDomain(ctx context.Context, tx nbstore.Store, accountID, serviceDomain, cluster string) error {
+	if _, ok := ExtractClusterFromFreeDomain(serviceDomain, []string{cluster}); ok {
+		return nil
+	}
+	name, err := nbdomain.FromString(serviceDomain)
+	if err != nil {
+		return status.Errorf(status.InvalidArgument, "invalid service domain: %v", err)
+	}
+	customDomains, err := tx.LockCustomDomains(ctx, accountID, name)
+	if err != nil {
+		return err
+	}
+	target, match := extractClusterFromCustomDomains(serviceDomain, customDomains)
+	if match != customDomainValidated || target != cluster {
+		return status.Errorf(status.PreconditionFailed, "custom domain authorization changed; retry the service operation")
+	}
+	return nil
+}
+
 func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]string, error) {
 	byopAddresses, err := m.proxyManager.GetActiveClusterAddressesForAccount(ctx, accountID)
 	if err != nil {

management/internals/modules/reverseproxy/proxy/manager.go

@@ -20,6 +20,8 @@ type Manager interface {
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsSessionCode(ctx context.Context, clusterAddr string) bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)
 	CountAccountProxies(ctx context.Context, accountID string) (int64, error)

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -8,6 +8,7 @@ import (
 	"go.opentelemetry.io/otel/metric"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	nbversion "github.com/netbirdio/netbird/version"
 )
 
 // store defines the interface for proxy persistence operations
@@ -22,6 +23,8 @@ type store interface {
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
+	GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error)
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	CountProxiesByAccountID(ctx context.Context, accountID string) (int64, error)
@@ -29,6 +32,8 @@ type store interface {
 	DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error
 }
 
+const minSessionCodeVersion = "0.81.0"
+
 // Manager handles all proxy operations
 type Manager struct {
 	store   store
@@ -145,6 +150,27 @@ func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string)
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)
 }
 
+// ClusterAllProxiesPrivate reports whether every active proxy claims the private capability (nil = unreported).
+func (m Manager) ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	return m.store.GetClusterAllProxiesPrivate(ctx, clusterAddr)
+}
+
+// ClusterSupportsSessionCode reports whether all active proxies support session codes.
+func (m Manager) ClusterSupportsSessionCode(ctx context.Context, clusterAddr string) bool {
+	versions, err := m.store.GetActiveProxyVersions(ctx, clusterAddr)
+	if err != nil || len(versions) == 0 {
+		return false
+	}
+
+	for _, version := range versions {
+		if supported, err := nbversion.MeetsMinVersion(minSessionCodeVersion, version); err != nil || !supported {
+			return false
+		}
+	}
+
+	return true
+}
+
 // CleanupStale removes proxies that haven't sent heartbeat in the specified duration
 func (m *Manager) CleanupStale(ctx context.Context, inactivityDuration time.Duration) error {
 	if err := m.store.CleanupStaleProxies(ctx, inactivityDuration); err != nil {

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -22,6 +22,7 @@ type mockStore struct {
 	updateProxyHeartbeatFunc                 func(ctx context.Context, p *proxy.Proxy) error
 	getActiveProxyClusterAddressesFunc       func(ctx context.Context) ([]string, error)
 	getActiveProxyClusterAddressesForAccFunc func(ctx context.Context, accountID string) ([]string, error)
+	getActiveProxyVersionsFunc               func(ctx context.Context, clusterAddress string) ([]string, error)
 	cleanupStaleProxiesFunc                  func(ctx context.Context, d time.Duration) error
 	getProxyByAccountIDFunc                  func(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	countProxiesByAccountIDFunc              func(ctx context.Context, accountID string) (int64, error)
@@ -104,6 +105,15 @@ func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }
+func (m *mockStore) GetClusterAllProxiesPrivate(_ context.Context, _ string) *bool {
+	return nil
+}
+func (m *mockStore) GetActiveProxyVersions(ctx context.Context, clusterAddress string) ([]string, error) {
+	if m.getActiveProxyVersionsFunc != nil {
+		return m.getActiveProxyVersionsFunc(ctx, clusterAddress)
+	}
+	return nil, nil
+}
 
 func newTestManager(s store) *Manager {
 	meter := noop.NewMeterProvider().Meter("test")
@@ -114,6 +124,34 @@ func newTestManager(s store) *Manager {
 	return m
 }
 
+func TestClusterSupportsSessionCode(t *testing.T) {
+	tests := []struct {
+		name     string
+		versions []string
+		storeErr error
+		want     bool
+	}{
+		{name: "all supported", versions: []string{"0.81.0", "0.81.2"}, want: true},
+		{name: "one old proxy", versions: []string{"0.81.0", "0.80.0"}},
+		{name: "missing version", versions: []string{"0.81.0", ""}},
+		{name: "no active proxies"},
+		{name: "store error", storeErr: errors.New("db error")},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &mockStore{
+				getActiveProxyVersionsFunc: func(_ context.Context, _ string) ([]string, error) {
+					return tt.versions, tt.storeErr
+				},
+			}
+
+			got := newTestManager(s).ClusterSupportsSessionCode(context.Background(), "cluster.example.com")
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
 func TestConnect_WithAccountID(t *testing.T) {
 	accountID := "acc-123"
 

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -56,6 +56,20 @@ func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration any) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
+// ClusterAllProxiesPrivate mocks base method.
+func (m *MockManager) ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterAllProxiesPrivate", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterAllProxiesPrivate indicates an expected call of ClusterAllProxiesPrivate.
+func (mr *MockManagerMockRecorder) ClusterAllProxiesPrivate(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterAllProxiesPrivate", reflect.TypeOf((*MockManager)(nil).ClusterAllProxiesPrivate), ctx, clusterAddr)
+}
+
 // ClusterRequireSubdomain mocks base method.
 func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -112,6 +126,20 @@ func (mr *MockManagerMockRecorder) ClusterSupportsPrivate(ctx, clusterAddr any)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsPrivate", reflect.TypeOf((*MockManager)(nil).ClusterSupportsPrivate), ctx, clusterAddr)
 }
 
+// ClusterSupportsSessionCode mocks base method.
+func (m *MockManager) ClusterSupportsSessionCode(ctx context.Context, clusterAddr string) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsSessionCode", ctx, clusterAddr)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// ClusterSupportsSessionCode indicates an expected call of ClusterSupportsSessionCode.
+func (mr *MockManagerMockRecorder) ClusterSupportsSessionCode(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsSessionCode", reflect.TypeOf((*MockManager)(nil).ClusterSupportsSessionCode), ctx, clusterAddr)
+}
+
 // Connect mocks base method.
 func (m *MockManager) Connect(ctx context.Context, proxyID, sessionID, clusterAddress, ipAddress, version string, accountID *string, capabilities *Capabilities) (*Proxy, error) {
 	m.ctrl.T.Helper()

management/internals/modules/reverseproxy/proxytoken/handler.go

@@ -1,6 +1,7 @@
 package proxytoken
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"time"
@@ -18,13 +19,29 @@ import (
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
+// RevocationGuard vetoes the tenant-facing revocation of a proxy access
+// token. Implementations are supplied by integrations; none is installed by
+// default, so every token the caller's account owns may be revoked. It is
+// consulted after the ownership check and before the token is revoked. A
+// returned status error is written with util.WriteError: its type selects the
+// HTTP status and its message is shown to the caller, so it must not carry
+// internal detail. Any other error is reported as a generic internal error.
+type RevocationGuard interface {
+	CheckProxyAccessTokenRevocation(ctx context.Context, token *types.ProxyAccessToken) error
+}
+
 type handler struct {
 	store              store.Store
 	permissionsManager permissions.Manager
+	// revocationGuard vetoes revocations. Optional — when nil every owned
+	// token may be revoked.
+	revocationGuard RevocationGuard
 }
 
-func RegisterEndpoints(s store.Store, permissionsManager permissions.Manager, router *mux.Router) {
-	h := &handler{store: s, permissionsManager: permissionsManager}
+// RegisterEndpoints registers the proxy token endpoints. revocationGuard is
+// optional; pass nil for no revocation policy.
+func RegisterEndpoints(s store.Store, permissionsManager permissions.Manager, revocationGuard RevocationGuard, router *mux.Router) {
+	h := &handler{store: s, permissionsManager: permissionsManager, revocationGuard: revocationGuard}
 	router.HandleFunc("/reverse-proxies/proxy-tokens", h.listTokens).Methods("GET", "OPTIONS")
 	router.HandleFunc("/reverse-proxies/proxy-tokens", h.createToken).Methods("POST", "OPTIONS")
 	router.HandleFunc("/reverse-proxies/proxy-tokens/{tokenId}", h.revokeToken).Methods("DELETE", "OPTIONS")
@@ -154,6 +171,13 @@ func (h *handler) revokeToken(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if h.revocationGuard != nil {
+		if err := h.revocationGuard.CheckProxyAccessTokenRevocation(ctx, token); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
 	if err := h.store.RevokeProxyAccessToken(ctx, tokenID); err != nil {
 		util.WriteErrorResponse("failed to revoke token", http.StatusInternalServerError, w)
 		return

management/internals/modules/reverseproxy/proxytoken/handler_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -22,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 func authContext(accountID, userID string) context.Context {
@@ -273,3 +275,152 @@ func TestRevokeToken_ManagementWideToken(t *testing.T) {
 	h.revokeToken(w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
+
+type revocationGuardFunc func(ctx context.Context, token *types.ProxyAccessToken) error
+
+func (f revocationGuardFunc) CheckProxyAccessTokenRevocation(ctx context.Context, token *types.ProxyAccessToken) error {
+	return f(ctx, token)
+}
+
+func TestRevokeToken_GuardRefuses(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	accountID := "acc-123"
+
+	// No RevokeProxyAccessToken expectation: a refused revocation must not
+	// reach the store.
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &accountID,
+	}, nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), accountID, "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	var checked *types.ProxyAccessToken
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(_ context.Context, token *types.ProxyAccessToken) error {
+			checked = token
+			return status.Errorf(status.PreconditionFailed, "token is in use")
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext(accountID, "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusPreconditionFailed, w.Code)
+	assert.Contains(t, w.Body.String(), "token is in use")
+	require.NotNil(t, checked)
+	assert.Equal(t, "tok-1", checked.ID)
+}
+
+func TestRevokeToken_GuardAllows(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	accountID := "acc-123"
+
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &accountID,
+	}, nil)
+	mockStore.EXPECT().RevokeProxyAccessToken(gomock.Any(), "tok-1").Return(nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), accountID, "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(context.Context, *types.ProxyAccessToken) error {
+			return nil
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext(accountID, "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
+func TestRevokeToken_GuardFailure(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	accountID := "acc-123"
+
+	// No RevokeProxyAccessToken expectation: a guard that cannot decide must
+	// not let the revocation through.
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &accountID,
+	}, nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), accountID, "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(context.Context, *types.ProxyAccessToken) error {
+			return errors.New("connection refused")
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext(accountID, "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Contains(t, w.Body.String(), "internal server error")
+	assert.NotContains(t, w.Body.String(), "connection refused")
+}
+
+func TestRevokeToken_GuardNotConsultedForForeignToken(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	otherAccount := "acc-other"
+
+	mockStore := store.NewMockStore(ctrl)
+	mockStore.EXPECT().GetProxyAccessTokenByID(gomock.Any(), store.LockingStrengthNone, "tok-1").Return(&types.ProxyAccessToken{
+		ID:        "tok-1",
+		AccountID: &otherAccount,
+	}, nil)
+
+	permsMgr := permissions.NewMockManager(ctrl)
+	permsMgr.EXPECT().ValidateUserPermissions(gomock.Any(), "acc-123", "user-1", modules.Services, operations.Delete).Return(true, context.Background(), nil)
+
+	// A foreign token must read as not found, not reveal through the guard's
+	// answer that it belongs to some account's managed proxy.
+	h := &handler{
+		store:              mockStore,
+		permissionsManager: permsMgr,
+		revocationGuard: revocationGuardFunc(func(context.Context, *types.ProxyAccessToken) error {
+			t.Fatal("guard consulted for a token the caller does not own")
+			return nil
+		}),
+	}
+
+	req := httptest.NewRequest("DELETE", "/reverse-proxies/proxy-tokens/tok-1", nil)
+	req = req.WithContext(authContext("acc-123", "user-1"))
+	req = mux.SetURLVars(req, map[string]string{"tokenId": "tok-1"})
+	w := httptest.NewRecorder()
+
+	h.revokeToken(w, req)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}

management/internals/modules/reverseproxy/service/manager/domain_validation_test.go

@@ -125,3 +125,53 @@ func TestUpdateService_RefusesMoveToUnvalidatedDomain(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "app.proven.example.com", stored.Domain, "the service must keep its original domain")
 }
+
+func TestCreateService_DomainDeletedBeforeWrite(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+
+	d, err := testStore.CreateCustomDomain(ctx, testAccountID, "proven.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	svc := newTestService("app.proven.example.com")
+	require.NoError(t, mgr.initializeServiceForCreate(ctx, testAccountID, svc))
+
+	// Delete after the initial authorization check, before the service transaction starts.
+	require.NoError(t, testStore.DeleteCustomDomain(ctx, testAccountID, d.ID))
+	err = mgr.persistNewService(ctx, testAccountID, svc)
+	require.Error(t, err, "an earlier validation result must not authorize a deleted registration")
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "the caller must receive a typed precondition error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "the service must require current domain authorization")
+	services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "the failed write must not leave a service")
+}
+
+func TestUpdateService_DomainDeletedBeforeWrite(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupIntegrationTest(t)
+	withRealDomainManager(t, mgr, testStore)
+	_, err := testStore.CreateCustomDomain(ctx, testAccountID, "original.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	d, err := testStore.CreateCustomDomain(ctx, testAccountID, "destination.example.com", validationTestCluster, true)
+	require.NoError(t, err)
+	svc, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.original.example.com"))
+	require.NoError(t, err)
+	moved := svc.Copy()
+	moved.Domain = "app.destination.example.com"
+	cluster, err := mgr.resolveEffectiveCluster(ctx, testAccountID, moved)
+	require.NoError(t, err)
+
+	require.NoError(t, testStore.DeleteCustomDomain(ctx, testAccountID, d.ID))
+	err = testStore.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		return mgr.executeServiceUpdate(ctx, tx, testAccountID, moved, &serviceUpdateInfo{}, nil, cluster)
+	})
+	require.Error(t, err, "a domain deleted after cluster resolution must reject the update")
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "the caller must receive a typed precondition error")
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "the move must require current domain authorization")
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, svc.ID)
+	require.NoError(t, err)
+	assert.Equal(t, svc.Domain, stored.Domain, "the service must retain its authorized domain")
+}

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -74,6 +74,7 @@ const unknownHostPlaceholder = "unknown"
 // ClusterDeriver derives the proxy cluster from a domain.
 type ClusterDeriver interface {
 	DeriveClusterFromDomain(ctx context.Context, accountID, domain string) (string, error)
+	ValidateServiceDomain(ctx context.Context, tx store.Store, accountID, domain, cluster string) error
 	GetClusterDomains() []string
 }
 
@@ -83,6 +84,7 @@ type CapabilityProvider interface {
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	ClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
 type Manager struct {
@@ -331,7 +333,14 @@ func (m *Manager) persistNewService(ctx context.Context, accountID string, svc *
 		return err
 	}
 
+	if err := m.validatePrivateClusterTargets(ctx, svc.Targets, svc.ProxyCluster); err != nil {
+		return err
+	}
+
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		if err := m.validateServiceDomain(ctx, transaction, accountID, svc, svc.ProxyCluster); err != nil {
+			return err
+		}
 		if svc.Domain != "" {
 			if err := m.checkDomainAvailable(ctx, transaction, svc.Domain, ""); err != nil {
 				return err
@@ -365,6 +374,43 @@ func (m *Manager) clusterCustomPorts(ctx context.Context, svc *service.Service)
 	return m.capabilities.ClusterSupportsCustomPorts(ctx, svc.ProxyCluster)
 }
 
+// validatePrivateClusterTargets rejects cluster and direct upstream targets unless
+// every active proxy in the service's cluster reports the private capability. The
+// mapping reaches all proxies in the cluster, so one non-private proxy would serve
+// these targets too. An unreported capability is treated as unsupported. Must be
+// called outside a transaction, like clusterCustomPorts.
+func (m *Manager) validatePrivateClusterTargets(ctx context.Context, targets []*service.Target, cluster string) error {
+	target := firstPrivateClusterTarget(targets)
+	if target == nil {
+		return nil
+	}
+
+	if private := m.capabilities.ClusterAllProxiesPrivate(ctx, cluster); private != nil && *private {
+		return nil
+	}
+
+	if target.TargetType == service.TargetTypeCluster {
+		return status.Errorf(status.InvalidArgument,
+			"target_type %q requires a proxy cluster with private mode enabled, cluster %s does not support it",
+			service.TargetTypeCluster, cluster)
+	}
+	return status.Errorf(status.InvalidArgument,
+		"direct_upstream requires a proxy cluster with private mode enabled, cluster %s does not support it", cluster)
+}
+
+// firstPrivateClusterTarget returns the first target that only a private cluster may serve.
+func firstPrivateClusterTarget(targets []*service.Target) *service.Target {
+	for _, target := range targets {
+		if target == nil {
+			continue
+		}
+		if target.TargetType == service.TargetTypeCluster || target.Options.DirectUpstream {
+			return target
+		}
+	}
+	return nil
+}
+
 // ensureL4Port auto-assigns a listen port when needed and validates cluster support.
 // customPorts must be pre-computed via clusterCustomPorts before entering a transaction.
 func (m *Manager) ensureL4Port(ctx context.Context, tx store.Store, svc *service.Service, customPorts *bool, serviceUpdate bool) error {
@@ -460,7 +506,14 @@ func (m *Manager) persistNewEphemeralService(ctx context.Context, accountID, pee
 		return err
 	}
 
+	if err := m.validatePrivateClusterTargets(ctx, svc.Targets, svc.ProxyCluster); err != nil {
+		return err
+	}
+
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		if err := m.validateServiceDomain(ctx, transaction, accountID, svc, svc.ProxyCluster); err != nil {
+			return err
+		}
 		if err := m.validateEphemeralPreconditions(ctx, transaction, accountID, peerID, svc); err != nil {
 			return err
 		}
@@ -577,6 +630,10 @@ func (m *Manager) persistServiceUpdate(ctx context.Context, accountID string, se
 		return nil, err
 	}
 
+	if err := m.validatePrivateClusterTargets(ctx, service.Targets, effectiveCluster); err != nil {
+		return nil, err
+	}
+
 	// Validate subdomain requirement *before* the transaction: the underlying
 	// capability lookup talks to the main DB pool, and SQLite's single-connection
 	// pool would self-deadlock if this ran while the tx already held the only
@@ -622,6 +679,9 @@ func (m *Manager) resolveEffectiveCluster(ctx context.Context, accountID string,
 }
 
 func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.Store, accountID string, service *service.Service, updateInfo *serviceUpdateInfo, customPorts *bool, effectiveCluster string) error {
+	if err := m.validateServiceDomain(ctx, transaction, accountID, service, effectiveCluster); err != nil {
+		return err
+	}
 	existingService, err := transaction.GetServiceByID(ctx, store.LockingStrengthUpdate, accountID, service.ID)
 	if err != nil {
 		return err
@@ -677,6 +737,13 @@ func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.St
 	return nil
 }
 
+func (m *Manager) validateServiceDomain(ctx context.Context, tx store.Store, accountID string, svc *service.Service, cluster string) error {
+	if m.clusterDeriver == nil {
+		return nil
+	}
+	return m.clusterDeriver.ValidateServiceDomain(ctx, tx, accountID, svc.Domain, cluster)
+}
+
 // validateL4PortDiffOnClusterDiff checks if custom L4 ports are configured and validates port changes across clusters.
 // It ensures no port changes if custom ports are unsupported for a given cluster and protocol mode.
 // Returns an error if validation fails, otherwise returns nil.

management/internals/modules/reverseproxy/service/manager/manager_test.go

@@ -433,8 +433,8 @@ func TestDeletePeerService_SourcePeerValidation(t *testing.T) {
 	newProxyServer := func(t *testing.T) *nbgrpc.ProxyServiceServer {
 		t.Helper()
 		tokenStore := nbgrpc.NewOneTimeTokenStore(context.Background(), testCacheStore(t))
-		pkceStore := nbgrpc.NewPKCEVerifierStore(context.Background(), testCacheStore(t))
-		srv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+		singleUseStore := nbgrpc.NewSingleUseStore(context.Background(), testCacheStore(t))
+		srv := nbgrpc.NewProxyServiceServer(nil, tokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
 		return srv
 	}
 
@@ -655,6 +655,10 @@ func (d *testClusterDeriver) GetClusterDomains() []string {
 	return d.domains
 }
 
+func (d *testClusterDeriver) ValidateServiceDomain(context.Context, store.Store, string, string, string) error {
+	return nil
+}
+
 const (
 	testAccountID = "test-account"
 	testPeerID    = "test-peer-1"
@@ -722,8 +726,8 @@ func setupIntegrationTest(t *testing.T) (*Manager, store.Store) {
 	}
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, testCacheStore(t))
-	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, testCacheStore(t))
+	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
 
 	proxyController, err := proxymanager.NewGRPCController(proxySrv, noop.NewMeterProvider().Meter(""))
 	require.NoError(t, err)
@@ -1146,8 +1150,8 @@ func TestDeleteService_DeletesTargets(t *testing.T) {
 	mockAcct := account.NewMockManager(ctrl)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, testCacheStore(t))
-	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, testCacheStore(t))
+	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil, nil, nil)
 
 	proxyController, err := proxymanager.NewGRPCController(proxySrv, noop.NewMeterProvider().Meter(""))
 	require.NoError(t, err)

management/internals/modules/reverseproxy/service/manager/private_cluster_test.go

@@ -0,0 +1,218 @@
+package manager
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/metric/noop"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// setupPrivateClusterTest wires the real proxy manager as the capability
+// provider and connects one proxy to testCluster reporting the given private
+// capability. A nil private connects no proxy, so the capability is unreported.
+func setupPrivateClusterTest(t *testing.T, private *bool) (*Manager, store.Store) {
+	t.Helper()
+
+	mgr, testStore := setupIntegrationTest(t)
+
+	proxyMgr, err := proxymanager.NewManager(testStore, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+	mgr.capabilities = proxyMgr
+
+	if private != nil {
+		connectTestProxy(t, proxyMgr, "proxy-1", &proxy.Capabilities{Private: private})
+	}
+
+	return mgr, testStore
+}
+
+func connectTestProxy(t *testing.T, proxyMgr *proxymanager.Manager, proxyID string, caps *proxy.Capabilities) {
+	t.Helper()
+	_, err := proxyMgr.Connect(context.Background(), proxyID, "session-"+proxyID, testCluster, "127.0.0.1", "", nil, caps)
+	require.NoError(t, err)
+}
+
+func clusterTarget() *rpservice.Target {
+	return &rpservice.Target{
+		TargetId:   testCluster,
+		TargetType: rpservice.TargetTypeCluster,
+		Host:       "backend.lan",
+		Port:       8080,
+		Protocol:   "http",
+		Enabled:    true,
+		Options:    rpservice.TargetOptions{DirectUpstream: true},
+	}
+}
+
+func directUpstreamPeerTarget() *rpservice.Target {
+	return &rpservice.Target{
+		TargetId:   testPeerID,
+		TargetType: rpservice.TargetTypePeer,
+		Host:       "backend.lan",
+		Port:       8080,
+		Protocol:   "http",
+		Enabled:    true,
+		Options:    rpservice.TargetOptions{DirectUpstream: true},
+	}
+}
+
+func TestCreateService_PrivateClusterTargets(t *testing.T) {
+	tests := []struct {
+		name    string
+		private *bool
+		target  *rpservice.Target
+		wantErr string
+	}{
+		{name: "cluster target on private cluster", private: boolPtr(true), target: clusterTarget()},
+		{name: "direct upstream on private cluster", private: boolPtr(true), target: directUpstreamPeerTarget()},
+		{name: "cluster target on non-private cluster", private: boolPtr(false), target: clusterTarget(), wantErr: `target_type "cluster" requires a proxy cluster with private mode enabled`},
+		{name: "direct upstream on non-private cluster", private: boolPtr(false), target: directUpstreamPeerTarget(), wantErr: "direct_upstream requires a proxy cluster with private mode enabled"},
+		{name: "cluster target with unreported capability", private: nil, target: clusterTarget(), wantErr: `target_type "cluster" requires a proxy cluster with private mode enabled`},
+		{name: "direct upstream with unreported capability", private: nil, target: directUpstreamPeerTarget(), wantErr: "direct_upstream requires a proxy cluster with private mode enabled"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore := setupPrivateClusterTest(t, tc.private)
+
+			svc := newTestService("app.test.netbird.io")
+			svc.Targets = []*rpservice.Target{tc.target}
+
+			_, err := mgr.CreateService(ctx, testAccountID, testUserID, svc)
+
+			services, listErr := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+			require.NoError(t, listErr)
+
+			if tc.wantErr == "" {
+				require.NoError(t, err)
+				assert.Len(t, services, 1, "the service should be persisted")
+				return
+			}
+
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantErr)
+			sErr, ok := status.FromError(err)
+			require.True(t, ok, "the caller must receive a typed error")
+			assert.Equal(t, status.InvalidArgument, sErr.Type(), "the rejection should be an invalid argument")
+			assert.Empty(t, services, "a rejected service must not be persisted")
+		})
+	}
+}
+
+// A cluster where only some proxies run in private mode must not accept these
+// targets: the mapping is delivered to every proxy in the cluster, so the
+// non-private ones would serve the target from their host network as well.
+func TestCreateService_MixedClusterRejectsPrivateTargets(t *testing.T) {
+	tests := []struct {
+		name       string
+		secondCaps *proxy.Capabilities
+	}{
+		{name: "second proxy reports not private", secondCaps: &proxy.Capabilities{Private: boolPtr(false)}},
+		{name: "second proxy predates capability reporting", secondCaps: nil},
+	}
+
+	for _, tc := range tests {
+		for _, target := range []*rpservice.Target{clusterTarget(), directUpstreamPeerTarget()} {
+			t.Run(tc.name+"/"+string(target.TargetType), func(t *testing.T) {
+				ctx := context.Background()
+				mgr, testStore := setupPrivateClusterTest(t, boolPtr(true))
+				connectTestProxy(t, mgr.capabilities.(*proxymanager.Manager), "proxy-2", tc.secondCaps)
+
+				svc := newTestService("app.test.netbird.io")
+				svc.Targets = []*rpservice.Target{target}
+
+				_, err := mgr.CreateService(ctx, testAccountID, testUserID, svc)
+				require.Error(t, err, "a cluster with a non-private proxy must not accept the target")
+				assert.Contains(t, err.Error(), "requires a proxy cluster with private mode enabled")
+
+				services, err := testStore.GetAccountServices(ctx, store.LockingStrengthNone, testAccountID)
+				require.NoError(t, err)
+				assert.Empty(t, services, "a rejected service must not be persisted")
+			})
+		}
+	}
+}
+
+func TestCreateService_RegularTargetIgnoresPrivateCapability(t *testing.T) {
+	ctx := context.Background()
+	mgr, _ := setupPrivateClusterTest(t, boolPtr(false))
+
+	_, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.test.netbird.io"))
+	require.NoError(t, err, "a peer target without direct upstream must not need a private cluster")
+}
+
+func TestUpdateService_PrivateClusterTargets(t *testing.T) {
+	tests := []struct {
+		name    string
+		target  *rpservice.Target
+		wantErr string
+	}{
+		{name: "switch to cluster target", target: clusterTarget(), wantErr: `target_type "cluster" requires a proxy cluster with private mode enabled`},
+		{name: "enable direct upstream", target: directUpstreamPeerTarget(), wantErr: "direct_upstream requires a proxy cluster with private mode enabled"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			mgr, testStore := setupPrivateClusterTest(t, boolPtr(false))
+
+			created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.test.netbird.io"))
+			require.NoError(t, err)
+
+			updated := newTestService("app.test.netbird.io")
+			updated.ID = created.ID
+			updated.AccountID = testAccountID
+			updated.Targets = []*rpservice.Target{tc.target}
+
+			_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantErr)
+
+			stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+			require.NoError(t, err)
+			require.Len(t, stored.Targets, 1)
+			assert.Equal(t, rpservice.TargetTypePeer, stored.Targets[0].TargetType, "the stored target must be unchanged")
+			assert.False(t, stored.Targets[0].Options.DirectUpstream, "the stored target must keep direct upstream disabled")
+		})
+	}
+}
+
+func TestUpdateService_PrivateClusterAllowsClusterTarget(t *testing.T) {
+	ctx := context.Background()
+	mgr, testStore := setupPrivateClusterTest(t, boolPtr(true))
+
+	created, err := mgr.CreateService(ctx, testAccountID, testUserID, newTestService("app.test.netbird.io"))
+	require.NoError(t, err)
+
+	updated := newTestService("app.test.netbird.io")
+	updated.ID = created.ID
+	updated.AccountID = testAccountID
+	updated.Targets = []*rpservice.Target{clusterTarget()}
+
+	_, err = mgr.UpdateService(ctx, testAccountID, testUserID, updated)
+	require.NoError(t, err)
+
+	stored, err := testStore.GetServiceByID(ctx, store.LockingStrengthNone, testAccountID, created.ID)
+	require.NoError(t, err)
+	require.Len(t, stored.Targets, 1)
+	assert.Equal(t, rpservice.TargetTypeCluster, stored.Targets[0].TargetType, "the cluster target should be stored")
+}
+
+func TestValidatePrivateClusterTargets_NoLookupWithoutPrivateTargets(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	// No ClusterAllProxiesPrivate expectation: a lookup would fail the test.
+	mgr := &Manager{capabilities: proxy.NewMockManager(ctrl)}
+
+	targets := []*rpservice.Target{{TargetId: testPeerID, TargetType: rpservice.TargetTypePeer}}
+	require.NoError(t, mgr.validatePrivateClusterTargets(context.Background(), targets, testCluster))
+}

management/internals/modules/zones/manager/manager.go

@@ -3,15 +3,16 @@ package manager
 import (
 	"context"
 	"fmt"
+	"slices"
 
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -69,6 +70,9 @@ func (m *managerImpl) CreateZone(ctx context.Context, accountID, userID string,
 	}
 
 	zone = zones.NewZone(accountID, zone.Name, zone.Domain, zone.Enabled, zone.EnableSearchDomain, zone.DistributionGroups)
+	var snap *affectedpeers.Snapshot
+	change := affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		existingZone, err := transaction.GetZoneByDomain(ctx, accountID, zone.Domain)
 		if err != nil {
@@ -88,7 +92,15 @@ func (m *managerImpl) CreateZone(ctx context.Context, accountID, userID string,
 		}
 
 		if err = transaction.CreateZone(ctx, zone); err != nil {
-			return fmt.Errorf("failed to create zone: %w", err)
+			return fmt.Errorf("create zone: %w", err)
+		}
+
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
+		if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
+			return fmt.Errorf("increment network serial: %w", err)
 		}
 
 		return nil
@@ -99,6 +111,8 @@ func (m *managerImpl) CreateZone(ctx context.Context, accountID, userID string,
 
 	m.accountManager.StoreEvent(ctx, userID, zone.ID, accountID, activity.DNSZoneCreated, zone.EventMeta())
 
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
+
 	return zone, nil
 }
 
@@ -111,21 +125,26 @@ func (m *managerImpl) UpdateZone(ctx context.Context, accountID, userID string,
 		return nil, status.NewPermissionDeniedError()
 	}
 
-	zone, err := m.store.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, updatedZone.ID)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get zone: %w", err)
-	}
-
-	if zone.Domain != updatedZone.Domain {
-		return nil, status.Errorf(status.InvalidArgument, "zone domain cannot be updated")
-	}
-
-	zone.Name = updatedZone.Name
-	zone.Enabled = updatedZone.Enabled
-	zone.EnableSearchDomain = updatedZone.EnableSearchDomain
-	zone.DistributionGroups = updatedZone.DistributionGroups
+	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, updatedZone.ID)
+		if err != nil {
+			return fmt.Errorf("get zone: %w", err)
+		}
+
+		if zone.Domain != updatedZone.Domain {
+			return status.Errorf(status.InvalidArgument, "zone domain cannot be updated")
+		}
+
+		oldGroups := zone.DistributionGroups
+		zone.Name = updatedZone.Name
+		zone.Enabled = updatedZone.Enabled
+		zone.EnableSearchDomain = updatedZone.EnableSearchDomain
+		zone.DistributionGroups = updatedZone.DistributionGroups
+
 		for _, groupID := range zone.DistributionGroups {
 			_, err = transaction.GetGroupByID(ctx, store.LockingStrengthNone, accountID, groupID)
 			if err != nil {
@@ -134,7 +153,16 @@ func (m *managerImpl) UpdateZone(ctx context.Context, accountID, userID string,
 		}
 
 		if err = transaction.UpdateZone(ctx, zone); err != nil {
-			return fmt.Errorf("failed to update zone: %w", err)
+			return fmt.Errorf("update zone: %w", err)
+		}
+
+		change = affectedpeers.Change{DistributionGroupIDs: slices.Concat(zone.DistributionGroups, oldGroups)}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
+		if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
+			return fmt.Errorf("increment network serial: %w", err)
 		}
 
 		return nil
@@ -145,7 +173,7 @@ func (m *managerImpl) UpdateZone(ctx context.Context, accountID, userID string,
 
 	m.accountManager.StoreEvent(ctx, userID, zone.ID, accountID, activity.DNSZoneUpdated, zone.EventMeta())
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZone, Operation: types.UpdateOperationUpdate})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return zone, nil
 }
@@ -159,13 +187,23 @@ func (m *managerImpl) DeleteZone(ctx context.Context, accountID, userID, zoneID
 		return status.NewPermissionDeniedError()
 	}
 
-	zone, err := m.store.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
-	if err != nil {
-		return fmt.Errorf("failed to get zone: %w", err)
-	}
-
+	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 	var eventsToStore []func()
+
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
+		if err != nil {
+			return fmt.Errorf("get zone: %w", err)
+		}
+
+		// Load before delete: the post-delete state no longer references the groups.
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		records, err := transaction.GetZoneDNSRecords(ctx, store.LockingStrengthNone, accountID, zoneID)
 		if err != nil {
 			return fmt.Errorf("failed to get records: %w", err)
@@ -207,7 +245,7 @@ func (m *managerImpl) DeleteZone(ctx context.Context, accountID, userID, zoneID
 		event()
 	}
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZone, Operation: types.UpdateOperationDelete})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return nil
 }

management/internals/modules/zones/records/manager/manager.go

@@ -9,11 +9,11 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -65,6 +65,8 @@ func (m *managerImpl) CreateRecord(ctx context.Context, accountID, userID, zoneI
 	}
 
 	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	record = records.NewRecord(accountID, zoneID, record.Name, record.Type, record.Content, record.TTL)
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -82,6 +84,11 @@ func (m *managerImpl) CreateRecord(ctx context.Context, accountID, userID, zoneI
 			return fmt.Errorf("failed to create dns record: %w", err)
 		}
 
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		err = transaction.IncrementNetworkSerial(ctx, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to increment network serial: %w", err)
@@ -96,7 +103,7 @@ func (m *managerImpl) CreateRecord(ctx context.Context, accountID, userID, zoneI
 	meta := record.EventMeta(zone.ID, zone.Name)
 	m.accountManager.StoreEvent(ctx, userID, record.ID, accountID, activity.DNSRecordCreated, meta)
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZoneRecord, Operation: types.UpdateOperationCreate})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return record, nil
 }
@@ -112,6 +119,8 @@ func (m *managerImpl) UpdateRecord(ctx context.Context, accountID, userID, zoneI
 
 	var zone *zones.Zone
 	var record *records.Record
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
@@ -141,6 +150,11 @@ func (m *managerImpl) UpdateRecord(ctx context.Context, accountID, userID, zoneI
 			return fmt.Errorf("failed to update dns record: %w", err)
 		}
 
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		err = transaction.IncrementNetworkSerial(ctx, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to increment network serial: %w", err)
@@ -155,7 +169,7 @@ func (m *managerImpl) UpdateRecord(ctx context.Context, accountID, userID, zoneI
 	meta := record.EventMeta(zone.ID, zone.Name)
 	m.accountManager.StoreEvent(ctx, userID, record.ID, accountID, activity.DNSRecordUpdated, meta)
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZoneRecord, Operation: types.UpdateOperationUpdate})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return record, nil
 }
@@ -171,6 +185,8 @@ func (m *managerImpl) DeleteRecord(ctx context.Context, accountID, userID, zoneI
 
 	var record *records.Record
 	var zone *zones.Zone
+	var snap *affectedpeers.Snapshot
+	var change affectedpeers.Change
 
 	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		zone, err = transaction.GetZoneByID(ctx, store.LockingStrengthUpdate, accountID, zoneID)
@@ -188,6 +204,11 @@ func (m *managerImpl) DeleteRecord(ctx context.Context, accountID, userID, zoneI
 			return fmt.Errorf("failed to delete dns record: %w", err)
 		}
 
+		change = affectedpeers.Change{DistributionGroupIDs: zone.DistributionGroups}
+		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
+			return fmt.Errorf("load affected peers: %w", err)
+		}
+
 		err = transaction.IncrementNetworkSerial(ctx, accountID)
 		if err != nil {
 			return fmt.Errorf("failed to increment network serial: %w", err)
@@ -202,7 +223,7 @@ func (m *managerImpl) DeleteRecord(ctx context.Context, accountID, userID, zoneI
 	meta := record.EventMeta(zone.ID, zone.Name)
 	m.accountManager.StoreEvent(ctx, userID, recordID, accountID, activity.DNSRecordDeleted, meta)
 
-	go m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourceZoneRecord, Operation: types.UpdateOperationDelete})
+	m.accountManager.ExpandAndUpdateAffected(ctx, accountID, snap, change)
 
 	return nil
 }

management/internals/server/boot.go

@@ -32,9 +32,11 @@ import (
 	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -43,10 +45,14 @@ import (
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	mgmtProto "github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 	"github.com/netbirdio/netbird/util/crypt"
 )
 
-const apiPrefix = "/api"
+const (
+	apiPrefix   = "/api"
+	apiV1Prefix = "/api/v1alpha1"
+)
 
 var (
 	kaep = keepalive.EnforcementPolicy{
@@ -84,9 +90,20 @@ func (s *BaseServer) CacheStore() nbcache.Store {
 	})
 }
 
+// DBConn opens the database connection shared by the store and the domain repositories.
+func (s *BaseServer) DBConn() *db.Conn {
+	return Create(s, func() *db.Conn {
+		conn, err := store.OpenConn(context.Background(), s.Config.StoreConfig.Engine, s.Config.Datadir)
+		if err != nil {
+			log.Fatalf("failed to open database connection: %v", err)
+		}
+		return conn
+	})
+}
+
 func (s *BaseServer) Store() store.Store {
 	return Create(s, func() store.Store {
-		store, err := store.NewStore(context.Background(), s.Config.StoreConfig.Engine, s.Config.Datadir, s.Metrics(), false)
+		store, err := store.NewSqlStore(context.Background(), s.DBConn(), s.Metrics(), false)
 		if err != nil {
 			log.Fatalf("failed to create store: %v", err)
 		}
@@ -146,13 +163,31 @@ func (s *BaseServer) EventStore() activity.Store {
 }
 
 func (s *BaseServer) APIHandler() http.Handler {
-	return Create(s, func() http.Handler {
-		httpAPIHandler, err := nbhttp.NewAPIHandler(context.Background(), s.Router(), s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(), s.GroupsManager(), s.GeoLocationManager(), s.AuthManager(), s.Metrics(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(), s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(), s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies, s.RateLimiter(), s.IsValidChildAccount, s.AgentNetworkManager())
+	_ = CreateNamed(s, "http_v1api", func() http.Handler {
+		apiv1Router := s.ApiV1Router()
+		_, err := v1alpha1.NewAPIV1Handler(context.Background(), apiv1Router, s.AccountManager(), s.NetworkMapController(), s.PermissionsManager())
 		if err != nil {
 			log.Fatalf("failed to create API handler: %v", err)
 		}
-		return httpAPIHandler
+
+		return apiv1Router
 	})
+
+	_ = CreateNamed(s, "http_v0api", func() http.Handler {
+		apiRouter := s.ApiRouter()
+		_, err := nbhttp.NewAPIHandler(
+			context.Background(), apiRouter, s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(),
+			s.GroupsManager(), s.GeoLocationManager(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(),
+			s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(),
+			s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies,
+			s.AgentNetworkManager(), nil)
+		if err != nil {
+			log.Fatalf("failed to create API handler: %v", err)
+		}
+		return apiRouter
+	})
+
+	return s.Router()
 }
 
 // IDPHandler returns the HTTP handler for the embedded IdP (Dex), or nil if
@@ -165,16 +200,35 @@ func (s *BaseServer) IDPHandler() http.Handler {
 	return cors.AllowAll().Handler(embeddedIdP.Handler())
 }
 
+// Router returns the root HTTP router with the shared API middleware applied.
 func (s *BaseServer) Router() *mux.Router {
 	return Create(s, func() *mux.Router {
-		return mux.NewRouter().PathPrefix(apiPrefix).Subrouter()
+		router := mux.NewRouter()
+		router.Use(middleware.BuildMiddleware(s.RateLimiter(), s.AuthManager(), s.AccountManager(), s.Metrics(), s.IsValidChildAccount)...)
+		return router
 	})
 }
 
-func (s *BaseServer) RateLimiter() *middleware.APIRateLimiter {
-	return Create(s, func() *middleware.APIRateLimiter {
-		cfg, enabled := middleware.RateLimiterConfigFromEnv()
-		limiter := middleware.NewAPIRateLimiter(cfg)
+// ApiV1Router returns the subrouter for the versioned API under apiV1Prefix.
+func (s *BaseServer) ApiV1Router() *mux.Router {
+	return CreateNamed(s, "apiv1_router", func() *mux.Router {
+		return s.Router().PathPrefix(apiV1Prefix).Subrouter()
+	})
+}
+
+// ApiRouter returns the subrouter for the unversioned API under apiPrefix.
+func (s *BaseServer) ApiRouter() *mux.Router {
+	return CreateNamed(s, "apiv0_router", func() *mux.Router {
+		// The nested versioned prefix must be registered before the broader apiPrefix.
+		s.ApiV1Router()
+		return s.Router().PathPrefix(apiPrefix).Subrouter()
+	})
+}
+
+func (s *BaseServer) RateLimiter() *ratelimit.APIRateLimiter {
+	return Create(s, func() *ratelimit.APIRateLimiter {
+		cfg, enabled := ratelimit.RateLimiterConfigFromEnv()
+		limiter := ratelimit.NewAPIRateLimiter(cfg)
 		limiter.SetEnabled(enabled)
 		return limiter
 	})
@@ -236,7 +290,7 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 
 func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 	return Create(s, func() *nbgrpc.ProxyServiceServer {
-		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.PKCEVerifierStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
+		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.SingleUseStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
 			proxyService.SetActivityManager(s.ProxyActivityManager())
@@ -293,9 +347,9 @@ func (s *BaseServer) ProxyTokenStore() *nbgrpc.OneTimeTokenStore {
 	})
 }
 
-func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
-	return Create(s, func() *nbgrpc.PKCEVerifierStore {
-		return nbgrpc.NewPKCEVerifierStore(context.Background(), s.CacheStore())
+func (s *BaseServer) SingleUseStore() *nbgrpc.SingleUseStore {
+	return Create(s, func() *nbgrpc.SingleUseStore {
+		return nbgrpc.NewSingleUseStore(context.Background(), s.CacheStore())
 	})
 }
 
@@ -308,7 +362,7 @@ func (s *BaseServer) ProxyActivityManager() proxyactivity.Manager {
 
 func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	return Create(s, func() accesslogs.Manager {
-		accessLogManager := accesslogsmanager.NewManager(s.Store(), s.PermissionsManager(), s.GeoLocationManager())
+		accessLogManager := accesslogsmanager.NewManager(accesslogsmanager.NewRepository(s.DBConn()), s.Store(), s.PermissionsManager(), s.GeoLocationManager())
 		accessLogManager.StartPeriodicCleanup(
 			context.Background(),
 			s.Config.ReverseProxy.AccessLogRetentionDays,

management/internals/server/controllers.go

@@ -5,8 +5,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/management-integrations/integrations"
-
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	proxymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy/manager"
 
@@ -20,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator/validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
 )
@@ -52,12 +49,6 @@ func (s *BaseServer) IntegratedValidator() integrated_validator.IntegratedValida
 	})
 }
 
-func (s *BaseServer) ProxyController() port_forwarding.Controller {
-	return Create(s, func() port_forwarding.Controller {
-		return integrations.NewController(s.Store())
-	})
-}
-
 func (s *BaseServer) SecretsManager() grpc.SecretsManager {
 	return Create(s, func() grpc.SecretsManager {
 		secretsManager, err := grpc.NewTimeBasedAuthSecretsManager(s.PeersUpdateManager(), s.Config.TURNConfig, s.Config.Relay, s.SettingsManager(), s.GroupsManager())
@@ -123,7 +114,7 @@ func (s *BaseServer) EphemeralManager() ephemeral.Manager {
 
 func (s *BaseServer) NetworkMapController() network_map.Controller {
 	return Create(s, func() network_map.Controller {
-		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.ProxyController(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
+		return nmapcontroller.NewController(context.Background(), s.Store(), s.Metrics(), s.PeersUpdateManager(), s.AccountRequestBuffer(), s.IntegratedValidator(), s.SettingsManager(), s.DNSDomain(), s.EphemeralManager(), s.Config, s.NetworkMapStore())
 	})
 }
 

management/internals/server/modules.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/netbirdio/management-integrations/integrations"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -20,7 +21,6 @@ import (
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -96,13 +96,14 @@ func (s *BaseServer) PeersManager() peers.Manager {
 
 func (s *BaseServer) AccountManager() account.Manager {
 	return Create(s, func() account.Manager {
-		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.ProxyController(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
+		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
 		if err != nil {
 			log.Fatalf("failed to create account service: %v", err)
 		}
 
 		s.AfterInit(func(s *BaseServer) {
 			accountManager.SetServiceManager(s.ServiceManager())
+			accountManager.AddAccountDeletionHook(s.AgentNetworkManager().RemoveAccountGateway)
 		})
 
 		return accountManager

management/internals/shared/db/conn.go

@@ -0,0 +1,121 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"strconv"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+)
+
+const (
+	defaultTransactionTimeout = 5 * time.Minute
+	connMaxLifetime           = time.Hour
+	connMaxIdleTime           = 3 * time.Minute
+)
+
+// TxMetrics receives the duration of every committed top-level transaction.
+type TxMetrics interface {
+	CountTransactionDuration(duration time.Duration)
+}
+
+// Conn is the database connection shared by all repositories: one gorm handle,
+// the pgx pool of a Postgres deployment and the engine they talk to.
+type Conn struct {
+	db        *gorm.DB
+	pool      *pgxpool.Pool
+	engine    Engine
+	txTimeout time.Duration
+	metrics   TxMetrics
+}
+
+// NewConn takes ownership of an open gorm handle and pool once it returns
+// without error, applying the connection limits and transaction timeout
+// configured through the environment.
+func NewConn(ctx context.Context, gormDB *gorm.DB, engine Engine, pool *pgxpool.Pool) (*Conn, error) {
+	sqlDB, err := gormDB.DB()
+	if err != nil {
+		return nil, err
+	}
+
+	txTimeout := defaultTransactionTimeout
+	if v := os.Getenv("NB_STORE_TRANSACTION_TIMEOUT"); v != "" {
+		if parsed, err := time.ParseDuration(v); err == nil {
+			txTimeout = parsed
+		}
+	}
+	log.WithContext(ctx).Infof("Setting transaction timeout to %v", txTimeout)
+
+	conns := runtime.NumCPU()
+	configuredConns, err := strconv.Atoi(os.Getenv("NB_SQL_MAX_OPEN_CONNS"))
+	connsConfigured := err == nil
+	if connsConfigured {
+		conns = configuredConns
+	}
+	if engine == SqliteStoreEngine {
+		if connsConfigured {
+			log.WithContext(ctx).Warnf("setting NB_SQL_MAX_OPEN_CONNS is not supported for sqlite, using default value 1")
+		}
+		conns = 1
+	}
+
+	sqlDB.SetMaxOpenConns(conns)
+	sqlDB.SetMaxIdleConns(conns)
+	sqlDB.SetConnMaxLifetime(connMaxLifetime)
+	sqlDB.SetConnMaxIdleTime(connMaxIdleTime)
+
+	log.WithContext(ctx).Infof("Set max open db connections to %d, max idle to %d, max lifetime to %v, max idle time to %v",
+		conns, conns, connMaxLifetime, connMaxIdleTime)
+
+	return &Conn{db: gormDB, pool: pool, engine: engine, txTimeout: txTimeout}, nil
+}
+
+// DB returns the handle a query must run on: the transaction when tx is set,
+// otherwise the shared connection.
+func (c *Conn) DB(tx *Tx) *gorm.DB {
+	if tx != nil {
+		return tx.db
+	}
+	return c.db
+}
+
+// Pool returns the pgx pool for read paths that bypass gorm. It is nil on
+// engines other than Postgres and inside a transaction, where the pool would
+// not see the uncommitted writes.
+func (c *Conn) Pool(tx *Tx) *pgxpool.Pool {
+	if tx != nil {
+		return nil
+	}
+	return c.pool
+}
+
+func (c *Conn) Engine() Engine {
+	return c.engine
+}
+
+// SetTxMetrics registers the sink that receives transaction durations.
+func (c *Conn) SetTxMetrics(metrics TxMetrics) {
+	c.metrics = metrics
+}
+
+// AutoMigrate creates or updates the tables of the given models.
+func (c *Conn) AutoMigrate(models ...any) error {
+	return c.db.AutoMigrate(models...)
+}
+
+// Close releases the gorm connection and the pgx pool.
+func (c *Conn) Close() error {
+	if c.pool != nil {
+		c.pool.Close()
+	}
+	sqlDB, err := c.db.DB()
+	if err != nil {
+		return fmt.Errorf("get db: %w", err)
+	}
+	return sqlDB.Close()
+}

management/internals/shared/db/conn_test.go

@@ -0,0 +1,148 @@
+package db
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+type testRow struct {
+	ID   uint `gorm:"primaryKey"`
+	Name string
+}
+
+func openTestConn(t *testing.T) *Conn {
+	t.Helper()
+	conn, err := OpenSqliteFile(context.Background(), t.TempDir(), SqliteFileName)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, conn.Close()) })
+	require.NoError(t, conn.AutoMigrate(&testRow{}))
+	return conn
+}
+
+func countRows(t *testing.T, conn *Conn) int64 {
+	t.Helper()
+	var count int64
+	require.NoError(t, conn.DB(nil).Model(&testRow{}).Count(&count).Error)
+	return count
+}
+
+func TestNewConn_ReadsTransactionTimeoutFromEnv(t *testing.T) {
+	t.Setenv("NB_STORE_TRANSACTION_TIMEOUT", "1s")
+	conn := openTestConn(t)
+	assert.Equal(t, time.Second, conn.txTimeout)
+	assert.Equal(t, SqliteStoreEngine, conn.Engine())
+}
+
+func TestRunInTx_CommitsOnSuccess(t *testing.T) {
+	conn := openTestConn(t)
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		return conn.DB(tx).Create(&testRow{Name: "a"}).Error
+	})
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, countRows(t, conn))
+}
+
+func TestRunInTx_RollsBackOnError(t *testing.T) {
+	conn := openTestConn(t)
+	failure := errors.New("boom")
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		require.NoError(t, conn.DB(tx).Create(&testRow{Name: "a"}).Error)
+		return failure
+	})
+	require.ErrorIs(t, err, failure)
+	assert.EqualValues(t, 0, countRows(t, conn))
+}
+
+func TestRunInTx_RollsBackOnPanic(t *testing.T) {
+	conn := openTestConn(t)
+
+	require.Panics(t, func() {
+		_ = conn.RunInTx(context.Background(), func(tx *Tx) error {
+			require.NoError(t, conn.DB(tx).Create(&testRow{Name: "a"}).Error)
+			panic("boom")
+		})
+	})
+	assert.EqualValues(t, 0, countRows(t, conn))
+}
+
+func TestRunInTx_FailsWhenTimeoutExceeded(t *testing.T) {
+	t.Setenv("NB_STORE_TRANSACTION_TIMEOUT", "50ms")
+	conn := openTestConn(t)
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		time.Sleep(100 * time.Millisecond)
+		return conn.DB(tx).Create(&testRow{Name: "a"}).Error
+	})
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.EqualValues(t, 0, countRows(t, conn))
+}
+
+func TestRunInTx_ReportsDurationToMetrics(t *testing.T) {
+	conn := openTestConn(t)
+	metrics := &recordingMetrics{}
+	conn.SetTxMetrics(metrics)
+
+	require.NoError(t, conn.RunInTx(context.Background(), func(*Tx) error { return nil }))
+	assert.Equal(t, 1, metrics.calls)
+}
+
+func TestConn_DBSelectsTransactionHandle(t *testing.T) {
+	conn := openTestConn(t)
+	assert.Same(t, conn.db, conn.DB(nil))
+
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		assert.Same(t, tx.db, conn.DB(tx))
+		assert.NotSame(t, conn.db, conn.DB(tx))
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestConn_PoolIsUnavailableInsideTransaction(t *testing.T) {
+	conn := openTestConn(t)
+	conn.pool = &pgxpool.Pool{}
+	defer func() { conn.pool = nil }()
+
+	assert.Same(t, conn.pool, conn.Pool(nil))
+	err := conn.RunInTx(context.Background(), func(tx *Tx) error {
+		assert.Nil(t, conn.Pool(tx))
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+type recordingMetrics struct {
+	calls int
+}
+
+func (m *recordingMetrics) CountTransactionDuration(time.Duration) {
+	m.calls++
+}
+
+func TestNewConn_MaxOpenConnsFromEnv(t *testing.T) {
+	t.Setenv("NB_SQL_MAX_OPEN_CONNS", "7")
+
+	gormDB, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "store.db")), GormConfig())
+	require.NoError(t, err)
+	conn, err := NewConn(context.Background(), gormDB, PostgresStoreEngine, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	sqlDB, err := conn.DB(nil).DB()
+	require.NoError(t, err)
+	assert.Equal(t, 7, sqlDB.Stats().MaxOpenConnections)
+
+	sqliteDB, err := openTestConn(t).DB(nil).DB()
+	require.NoError(t, err)
+	assert.Equal(t, 1, sqliteDB.Stats().MaxOpenConnections)
+}

management/internals/shared/db/dbtest/dbtest.go

@@ -0,0 +1,23 @@
+package dbtest
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+)
+
+// NewConn opens a fresh SQLite database in a temporary directory, migrates the
+// given models and closes the connection when the test ends. It ignores
+// NB_STORE_ENGINE_SQLITE_FILE, so a developer's configured database is never
+// touched, and is safe to call from parallel tests.
+func NewConn(t testing.TB, models ...any) *db.Conn {
+	t.Helper()
+	conn, err := db.OpenSqliteFile(context.Background(), t.TempDir(), db.SqliteFileName)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	require.NoError(t, conn.AutoMigrate(models...))
+	return conn
+}

management/internals/shared/db/dbtest/dbtest_test.go

@@ -0,0 +1,31 @@
+package dbtest
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/shared/db"
+)
+
+func TestNewConn_IgnoresSqliteFileOverride(t *testing.T) {
+	override := filepath.Join(t.TempDir(), "configured.db")
+	t.Setenv("NB_STORE_ENGINE_SQLITE_FILE", override)
+
+	conn := NewConn(t)
+
+	assert.Equal(t, db.SqliteStoreEngine, conn.Engine())
+	_, err := os.Stat(override)
+	require.ErrorIs(t, err, os.ErrNotExist)
+}
+
+func TestNewConn_Parallel(t *testing.T) {
+	t.Parallel()
+
+	conn := NewConn(t)
+
+	assert.Equal(t, db.SqliteStoreEngine, conn.Engine())
+}

management/internals/shared/db/engine.go

@@ -0,0 +1,10 @@
+package db
+
+// Engine identifies the SQL engine behind a Conn.
+type Engine string
+
+const (
+	SqliteStoreEngine   Engine = "sqlite"
+	PostgresStoreEngine Engine = "postgres"
+	MysqlStoreEngine    Engine = "mysql"
+)

management/internals/shared/db/lock.go

@@ -0,0 +1,12 @@
+package db
+
+// LockingStrength is the row lock a query holds until its transaction ends.
+type LockingStrength string
+
+const (
+	LockingStrengthUpdate      LockingStrength = "UPDATE"
+	LockingStrengthShare       LockingStrength = "SHARE"
+	LockingStrengthNoKeyUpdate LockingStrength = "NO KEY UPDATE"
+	LockingStrengthKeyShare    LockingStrength = "KEY SHARE"
+	LockingStrengthNone        LockingStrength = "NONE"
+)

management/internals/shared/db/open.go

@@ -0,0 +1,176 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+// SqliteFileName is the default SQLite database file inside the data directory.
+const SqliteFileName = "store.db"
+
+// PoolConfig sizes the pgx pool a Postgres deployment uses for the read paths
+// that bypass gorm.
+type PoolConfig struct {
+	MaxConns          int32
+	MinConns          int32
+	MaxConnLifetime   time.Duration
+	HealthCheckPeriod time.Duration
+}
+
+var DefaultPoolConfig = PoolConfig{
+	MaxConns:          30,
+	MinConns:          1,
+	MaxConnLifetime:   60 * time.Minute,
+	HealthCheckPeriod: time.Minute,
+}
+
+// GormConfig is the configuration every engine is opened with.
+func GormConfig() *gorm.Config {
+	return &gorm.Config{
+		Logger:          logger.Default.LogMode(logger.Silent),
+		CreateBatchSize: 400,
+	}
+}
+
+// OpenSqlite opens the SQLite database in dataDir, or the file named by
+// NB_STORE_ENGINE_SQLITE_FILE.
+func OpenSqlite(ctx context.Context, dataDir string) (*Conn, error) {
+	storeFile := SqliteFileName
+	if envFile, ok := os.LookupEnv("NB_STORE_ENGINE_SQLITE_FILE"); ok && envFile != "" {
+		storeFile = envFile
+	}
+	return OpenSqliteFile(ctx, dataDir, storeFile)
+}
+
+// OpenSqliteFile opens the SQLite database storeFile, resolved against dataDir
+// when relative. storeFile may carry SQLite URI query parameters.
+func OpenSqliteFile(ctx context.Context, dataDir, storeFile string) (*Conn, error) {
+	// Separate file path from any SQLite URI query parameters (e.g., "store.db?mode=rwc")
+	filePath, query, hasQuery := strings.Cut(storeFile, "?")
+
+	connStr := filePath
+	if !filepath.IsAbs(filePath) {
+		connStr = filepath.Join(dataDir, filePath)
+	}
+
+	// Compose query parameters. User-provided ?_busy_timeout (or its mattn alias
+	// ?_timeout) overrides our default; otherwise inject 30s so SQLite waits at
+	// most that long on a lock instead of blocking the only Go-side connection.
+	// mattn/go-sqlite3 applies PRAGMA from the DSN on every fresh connection, so
+	// the value survives ConnMaxIdleTime/ConnMaxLifetime recycling. cache=shared
+	// stays the default on non-Windows for the same reason as before.
+	parsed, _ := url.ParseQuery(query)
+	var defaults []string
+	if parsed.Get("_busy_timeout") == "" && parsed.Get("_timeout") == "" {
+		defaults = append(defaults, "_busy_timeout=30000")
+	}
+	if !hasQuery && runtime.GOOS != "windows" {
+		// To avoid `The process cannot access the file because it is being used by another process` on Windows
+		defaults = append(defaults, "cache=shared")
+	}
+	parts := defaults
+	if hasQuery {
+		parts = append(parts, query)
+	}
+	if len(parts) > 0 {
+		connStr += "?" + strings.Join(parts, "&")
+	}
+
+	gormDB, err := gorm.Open(sqlite.Open(connStr), GormConfig())
+	if err != nil {
+		return nil, err
+	}
+	conn, err := NewConn(ctx, gormDB, SqliteStoreEngine, nil)
+	if err != nil {
+		closeGorm(gormDB)
+		return nil, err
+	}
+	return conn, nil
+}
+
+// OpenPostgres opens a Postgres database through gorm and a pgx pool sized by pool.
+func OpenPostgres(ctx context.Context, dsn string, pool PoolConfig) (*Conn, error) {
+	gormDB, err := gorm.Open(postgres.Open(dsn), GormConfig())
+	if err != nil {
+		return nil, err
+	}
+	pgxPool, err := newPgxPool(ctx, dsn, pool)
+	if err != nil {
+		closeGorm(gormDB)
+		return nil, err
+	}
+	conn, err := NewConn(ctx, gormDB, PostgresStoreEngine, pgxPool)
+	if err != nil {
+		pgxPool.Close()
+		closeGorm(gormDB)
+		return nil, err
+	}
+	return conn, nil
+}
+
+// MysqlDSN adds the connection parameters every MySQL handle needs, keeping
+// the options already present in dsn.
+func MysqlDSN(dsn string) string {
+	separator := "?"
+	if strings.Contains(dsn, "?") {
+		separator = "&"
+	}
+	return dsn + separator + "charset=utf8&parseTime=True&loc=Local"
+}
+
+// OpenMysql opens a MySQL database through gorm.
+func OpenMysql(ctx context.Context, dsn string) (*Conn, error) {
+	gormDB, err := gorm.Open(mysql.Open(MysqlDSN(dsn)), GormConfig())
+	if err != nil {
+		return nil, err
+	}
+	conn, err := NewConn(ctx, gormDB, MysqlStoreEngine, nil)
+	if err != nil {
+		closeGorm(gormDB)
+		return nil, err
+	}
+	return conn, nil
+}
+
+func newPgxPool(ctx context.Context, dsn string, cfg PoolConfig) (*pgxpool.Pool, error) {
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse database config: %w", err)
+	}
+
+	config.MaxConns = cfg.MaxConns
+	config.MinConns = cfg.MinConns
+	config.MaxConnLifetime = cfg.MaxConnLifetime
+	config.HealthCheckPeriod = cfg.HealthCheckPeriod
+
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create connection pool: %w", err)
+	}
+
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("unable to ping database: %w", err)
+	}
+
+	return pool, nil
+}
+
+func closeGorm(gormDB *gorm.DB) {
+	if sqlDB, err := gormDB.DB(); err == nil {
+		_ = sqlDB.Close()
+	}
+}

management/internals/shared/db/open_test.go

@@ -0,0 +1,12 @@
+package db
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMysqlDSN(t *testing.T) {
+	assert.Equal(t, "user:pw@tcp(host:3306)/db?charset=utf8&parseTime=True&loc=Local", MysqlDSN("user:pw@tcp(host:3306)/db"))
+	assert.Equal(t, "user:pw@tcp(host:3306)/db?tls=true&charset=utf8&parseTime=True&loc=Local", MysqlDSN("user:pw@tcp(host:3306)/db?tls=true"))
+}

management/internals/shared/db/transaction.go

@@ -0,0 +1,105 @@
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"runtime/debug"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+)
+
+// Tx is an open transaction handed to repository calls; nil means autocommit.
+type Tx struct {
+	db *gorm.DB
+}
+
+// RunInTx runs fn in one transaction that commits when fn returns nil and rolls
+// back otherwise, bounded by the configured transaction timeout.
+func (c *Conn) RunInTx(ctx context.Context, fn func(tx *Tx) error) error {
+	timeoutCtx, cancel := context.WithTimeout(ctx, c.txTimeout)
+	defer cancel()
+
+	startTime := time.Now()
+	tx := c.db.WithContext(timeoutCtx).Begin()
+	if tx.Error != nil {
+		return tx.Error
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+			panic(r)
+		}
+	}()
+
+	if err := c.applyStatementTimeouts(tx); err != nil {
+		tx.Rollback()
+		return err
+	}
+
+	err := c.withForeignKeyChecksDisabled(tx, func() error {
+		return fn(&Tx{db: tx})
+	})
+	if err != nil {
+		tx.Rollback()
+		c.logIfTimedOut(ctx, timeoutCtx, err, "transaction", startTime)
+		return err
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		c.logIfTimedOut(ctx, timeoutCtx, err, "transaction commit", startTime)
+		return err
+	}
+
+	log.WithContext(ctx).Tracef("transaction took %v", time.Since(startTime))
+	if c.metrics != nil {
+		c.metrics.CountTransactionDuration(time.Since(startTime))
+	}
+	return nil
+}
+
+func (c *Conn) applyStatementTimeouts(tx *gorm.DB) error {
+	if c.engine != PostgresStoreEngine {
+		return nil
+	}
+	if err := tx.Exec("SET LOCAL statement_timeout = '1min'").Error; err != nil {
+		return fmt.Errorf("failed to set statement timeout: %w", err)
+	}
+	if err := tx.Exec("SET LOCAL lock_timeout = '1min'").Error; err != nil {
+		return fmt.Errorf("failed to set lock timeout: %w", err)
+	}
+	return nil
+}
+
+// withForeignKeyChecksDisabled runs fn with MySQL's FK checks off, which avoids
+// deadlocks on MySQL and Aurora without needing SUPER privilege. The setting is
+// session-scoped and survives a rollback, so it is turned back on whenever fn
+// returns or panics; otherwise the pooled connection would keep it disabled.
+func (c *Conn) withForeignKeyChecksDisabled(tx *gorm.DB, fn func() error) (err error) {
+	if c.engine != MysqlStoreEngine {
+		return fn()
+	}
+	if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 0").Error; err != nil {
+		return fmt.Errorf("failed to disable FK checks: %w", err)
+	}
+	defer func() {
+		restoreErr := tx.Exec("SET FOREIGN_KEY_CHECKS = 1").Error
+		if restoreErr == nil {
+			return
+		}
+		if err == nil {
+			err = fmt.Errorf("failed to re-enable FK checks: %w", restoreErr)
+			return
+		}
+		log.WithContext(tx.Statement.Context).Warnf("failed to re-enable FK checks after failed transaction: %v", restoreErr)
+	}()
+	return fn()
+}
+
+func (c *Conn) logIfTimedOut(ctx, timeoutCtx context.Context, err error, phase string, startTime time.Time) {
+	if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) {
+		log.WithContext(ctx).Warnf("%s exceeded %s timeout after %v, stack: %s", phase, c.txTimeout, time.Since(startTime), debug.Stack())
+	}
+}

management/internals/shared/grpc/components_encoder.go

@@ -28,10 +28,6 @@ type ComponentsEnvelopeInput struct {
 	// SshAuth.UserIDClaim when reconstructing the NetworkMap. Empty value
 	// is OK — client treats empty as "no SshAuth to build".
 	UserIDClaim string
-	// ProxyPatch carries pre-expanded NetworkMap fragments injected by
-	// external controllers (BYOP/port-forwarding). Nil when no proxy data
-	// is present; encoder skips the field in that case.
-	ProxyPatch *proto.ProxyPatch
 }
 
 // EncodeNetworkMapEnvelope converts NetworkMapComponents into the component
@@ -69,7 +65,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 					DnsForwarderPort: in.DNSForwarderPort,
 					UserIdClaim:      in.UserIDClaim,
 					AccountSettings:  &proto.AccountSettingsCompact{},
-					ProxyPatch:       in.ProxyPatch,
 				},
 			},
 		}
@@ -101,7 +96,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		AccountSettings:     toAccountSettingsCompact(c.AccountSettings),
 		DnsForwarderPort:    in.DNSForwarderPort,
 		UserIdClaim:         in.UserIDClaim,
-		ProxyPatch:          in.ProxyPatch,
 		DnsSettings:         enc.encodeDNSSettings(c.DNSSettings),
 		DnsDomain:           in.DNSDomain,
 		CustomZoneDomain:    c.CustomZoneDomain,

management/internals/shared/grpc/components_encoder_test.go

@@ -713,66 +713,6 @@ func TestEncodeNetworkMapEnvelope_GroupIDToUserIDs(t *testing.T) {
 	assert.ElementsMatch(t, []string{"user-4"}, full.GroupIdToUserIds["group-users"].UserIds)
 }
 
-func TestToProxyPatch_EmptyInputReturnsNil(t *testing.T) {
-	assert.Nil(t, toProxyPatch(nil, "netbird.cloud", false, false, false))
-	assert.Nil(t, toProxyPatch(&types.NetworkMap{}, "netbird.cloud", false, false, false),
-		"empty NetworkMap (no peers, rules, routes etc) → nil patch so proto3 omits the field")
-}
-
-func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
-	nm := &types.NetworkMap{
-		Peers: []*nmdata.Peer{{
-			ID: "ext-peer", Key: testWgKeyA, IP: netip.AddrFrom4([4]byte{100, 64, 0, 9}),
-			DNSLabel: "extpeer", Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
-		}},
-		FirewallRules: []*types.FirewallRule{{
-			PeerIP: "100.64.0.9", Action: "accept", Direction: 0, Protocol: "tcp",
-		}},
-	}
-
-	patch := toProxyPatch(nm, "netbird.cloud", false, false, false)
-
-	require.NotNil(t, patch)
-	assert.Len(t, patch.Peers, 1)
-	assert.Len(t, patch.FirewallRules, 1)
-}
-
-// TestEncodeNetworkMapEnvelope_ProxyPatchPropagated covers the ProxyPatch
-// pass-through in both encoder branches (normal path + nil-Components
-// graceful-degrade). Guards against a regression that drops `ProxyPatch:`
-// from one of the envelope struct literals.
-func TestEncodeNetworkMapEnvelope_ProxyPatchPropagated(t *testing.T) {
-	patch := &proto.ProxyPatch{
-		ForwardingRules: []*proto.ForwardingRule{{
-			Protocol:          proto.RuleProtocol_TCP,
-			DestinationPort:   &proto.PortInfo{PortSelection: &proto.PortInfo_Port{Port: 80}},
-			TranslatedAddress: net.IPv4(10, 0, 0, 1).To4(),
-			TranslatedPort:    &proto.PortInfo{PortSelection: &proto.PortInfo_Port{Port: 8080}},
-		}},
-	}
-
-	t.Run("normal_path", func(t *testing.T) {
-		c := newTestComponents()
-		full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-			Components: c,
-			ProxyPatch: patch,
-		}).GetFull()
-
-		require.NotNil(t, full.ProxyPatch, "ProxyPatch must propagate through the normal encode path")
-		assert.Len(t, full.ProxyPatch.ForwardingRules, 1)
-	})
-
-	t.Run("empty_components_graceful_degrade", func(t *testing.T) {
-		full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{
-			Components: emptyNetworkMapComponents(),
-			ProxyPatch: patch,
-		}).GetFull()
-
-		require.NotNil(t, full.ProxyPatch, "ProxyPatch must propagate through the nil-Components branch too")
-		assert.Len(t, full.ProxyPatch.ForwardingRules, 1)
-	})
-}
-
 func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	// nil Components → minimal envelope, no crash. Matches the legacy
 	// behaviour for missing/unvalidated peers.

management/internals/shared/grpc/components_envelope_response.go

@@ -9,7 +9,6 @@ import (
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/types"
 	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
 	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -34,7 +33,6 @@ func ToComponentSyncResponse(
 	turnCredentials *Token,
 	relayCredentials *Token,
 	components *types.NetworkMapComponents,
-	proxyPatch *types.NetworkMap,
 	dnsName string,
 	checks []*nmdata.PostureChecks,
 	settings *nmdata.AccountSettingsInfo,
@@ -52,9 +50,6 @@ func ToComponentSyncResponse(
 	enableSSH := computeSSHEnabledForPeer(components, peer)
 	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution, debugUploadDefault)
 
-	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
-	useSourcePrefixes := peer.SupportsSourcePrefixes()
-
 	userIDClaim := auth.DefaultUserIDClaim
 	if httpConfig != nil && httpConfig.AuthUserIDClaim != "" {
 		userIDClaim = httpConfig.AuthUserIDClaim
@@ -66,7 +61,6 @@ func ToComponentSyncResponse(
 		DNSDomain:        dnsName,
 		DNSForwarderPort: dnsFwdPort,
 		UserIDClaim:      userIDClaim,
-		ProxyPatch:       toProxyPatch(proxyPatch, dnsName, includeIPv6, useSourcePrefixes, peer.ProxyMeta.Embedded),
 	})
 
 	resp := &proto.SyncResponse{
@@ -92,43 +86,6 @@ func ToComponentSyncResponse(
 	return resp
 }
 
-// toProxyPatch converts a proxy-injected *types.NetworkMap into the wire
-// patch the components envelope ships alongside. Returns nil when there are
-// no fragments to merge — proto3 omits a nil message field, so the receiver
-// sees no patch and skips the merge step entirely.
-//
-// We reuse the legacy proto-conversion helpers (toProtocolRoutes,
-// toProtocolFirewallRules, toProtocolRoutesFirewallRules,
-// appendRemotePeerConfig, ForwardingRule.ToProto) because the proxy
-// delivers fragments pre-expanded — there's no raw component shape to
-// derive them from. Components purity isn't violated: proxy data isn't
-// policy-graph-derived, it's externally injected post-Calculate, so the
-// client merges it on top of its locally-computed NetworkMap.
-func toProxyPatch(nm *types.NetworkMap, dnsName string, includeIPv6, useSourcePrefixes, localIsProxy bool) *proto.ProxyPatch {
-	if nm == nil {
-		return nil
-	}
-	if len(nm.Peers) == 0 && len(nm.OfflinePeers) == 0 && len(nm.FirewallRules) == 0 &&
-		len(nm.Routes) == 0 && len(nm.RoutesFirewallRules) == 0 && len(nm.ForwardingRules) == 0 {
-		return nil
-	}
-
-	patch := &proto.ProxyPatch{
-		Peers:              networkmap.AppendRemotePeerConfig(nil, nm.Peers, dnsName, includeIPv6, localIsProxy),
-		OfflinePeers:       networkmap.AppendRemotePeerConfig(nil, nm.OfflinePeers, dnsName, includeIPv6, localIsProxy),
-		FirewallRules:      networkmap.ToProtocolFirewallRules(nm.FirewallRules, includeIPv6, useSourcePrefixes),
-		Routes:             networkmap.ToProtocolRoutes(nm.Routes),
-		RouteFirewallRules: networkmap.ToProtocolRoutesFirewallRules(nm.RoutesFirewallRules),
-	}
-	if len(nm.ForwardingRules) > 0 {
-		patch.ForwardingRules = make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, r := range nm.ForwardingRules {
-			patch.ForwardingRules = append(patch.ForwardingRules, r.ToProto())
-		}
-	}
-	return patch
-}
-
 // computeSSHEnabledForPeer mirrors the SSH-server-activation bit that
 // Calculate() folds into NetworkMap.EnableSSH. Components-format peers
 // receive a freshly-computed PeerConfig.SshConfig.SshEnabled at sync time;

management/internals/shared/grpc/conversion.go

@@ -217,14 +217,6 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	response.NetworkMap.RoutesFirewallRules = routesFirewallRules
 	response.NetworkMap.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if networkMap.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(networkMap.ForwardingRules))
-		for _, rule := range networkMap.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		response.NetworkMap.ForwardingRules = forwardingRules
-	}
-
 	if networkMap.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, networkMap.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim

management/internals/shared/grpc/loginfilter.go

@@ -14,6 +14,7 @@ const (
 	baseBlockDuration = 10 * time.Minute // Duration for which a peer is banned after exceeding the reconnection limit
 	reconnLimitForBan = 30               // Number of reconnections within the reconnTreshold that triggers a ban
 	metaChangeLimit   = 5                // Number of reconnections with different metadata that triggers a ban of one peer
+	maxBanLevel       = 6                // Highest ban level; the ban duration doubles per level up to this one
 )
 
 type lfConfig struct {
@@ -21,6 +22,7 @@ type lfConfig struct {
 	baseBlockDuration time.Duration
 	reconnLimitForBan int
 	metaChangeLimit   int
+	maxBanLevel       int
 }
 
 func initCfg() *lfConfig {
@@ -29,6 +31,7 @@ func initCfg() *lfConfig {
 		baseBlockDuration: baseBlockDuration,
 		reconnLimitForBan: reconnLimitForBan,
 		metaChangeLimit:   metaChangeLimit,
+		maxBanLevel:       maxBanLevel,
 	}
 }
 
@@ -102,11 +105,18 @@ func (l *loginFilter) addLogin(wgPubKey string, metaHash uint64) {
 		return
 	}
 
-	if state.isBanned && now.After(state.banExpiresAt) {
+	if state.isBanned {
+		if now.Before(state.banExpiresAt) {
+			return
+		}
 		state.isBanned = false
 	}
 
-	if state.banLevel > 0 && now.Sub(state.lastSeen) > (2*l.cfg.baseBlockDuration) {
+	quietSince := state.lastSeen
+	if state.banExpiresAt.After(quietSince) {
+		quietSince = state.banExpiresAt
+	}
+	if state.banLevel > 0 && now.Sub(quietSince) > (2*l.cfg.baseBlockDuration) {
 		state.banLevel = 0
 	}
 
@@ -124,10 +134,17 @@ func (l *loginFilter) addLogin(wgPubKey string, metaHash uint64) {
 		return
 	}
 
+	if now.Sub(state.sessionStart) >= l.cfg.reconnThreshold {
+		state.sessionStart = now
+		state.sessionCounter = 0
+	}
+
 	state.sessionCounter++
-	if state.sessionCounter > l.cfg.reconnLimitForBan && now.Sub(state.sessionStart) < l.cfg.reconnThreshold {
+	if state.sessionCounter > l.cfg.reconnLimitForBan {
 		state.isBanned = true
-		state.banLevel++
+		if state.banLevel < l.cfg.maxBanLevel {
+			state.banLevel++
+		}
 
 		backoffFactor := math.Pow(2, float64(state.banLevel-1))
 		duration := time.Duration(float64(l.cfg.baseBlockDuration) * backoffFactor)

management/internals/shared/grpc/loginfilter_test.go

@@ -20,6 +20,7 @@ func testAdvancedCfg() *lfConfig {
 		baseBlockDuration: 100 * time.Millisecond,
 		reconnLimitForBan: 3,
 		metaChangeLimit:   2,
+		maxBanLevel:       3,
 	}
 }
 
@@ -157,6 +158,187 @@ func (s *LoginFilterTestSuite) TestMetaChangeIsAllowedAfterWindowResets() {
 	s.Equal(1, s.filter.logged[pubKey].metaChangeCounter, "meta change counter should reset")
 }
 
+func (s *LoginFilterTestSuite) TestReconnectStormAfterQuietPeriodTriggersBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	s.filter.addLogin(pubKey, meta)
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.filter.logged[pubKey].sessionStart = time.Now().Add(-(s.filter.cfg.reconnThreshold + time.Second))
+
+	s.filter.addLogin(pubKey, meta)
+	s.Equal(1, s.filter.logged[pubKey].sessionCounter, "expired window should restart the count")
+
+	for i := 1; i < limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.False(s.filter.logged[pubKey].isBanned)
+
+	s.filter.addLogin(pubKey, meta)
+
+	s.False(s.filter.allowLogin(pubKey, meta))
+	s.True(s.filter.logged[pubKey].isBanned)
+}
+
+func (s *LoginFilterTestSuite) TestReconnectStormAfterBanExpiresTriggersBanAgain() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.Require().True(s.filter.logged[pubKey].isBanned)
+
+	expired := time.Now().Add(-(s.filter.cfg.baseBlockDuration + time.Second))
+	s.filter.logged[pubKey].banExpiresAt = expired
+	s.filter.logged[pubKey].sessionStart = expired
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(2, s.filter.logged[pubKey].banLevel)
+}
+
+func (s *LoginFilterTestSuite) TestSlowReconnectsAcrossWindowsDoNotBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	for i := 0; i < limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.filter.logged[pubKey].sessionStart = time.Now().Add(-(s.filter.cfg.reconnThreshold + time.Second))
+
+	for i := 0; i < limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.False(s.filter.logged[pubKey].isBanned)
+}
+
+func (s *LoginFilterTestSuite) TestBanLevelEscalatesWhenStormResumesRightAfterBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+	banTime := time.Now().Add(-3 * s.filter.cfg.baseBlockDuration)
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:  meta,
+		isBanned:     true,
+		banLevel:     1,
+		banExpiresAt: time.Now().Add(-time.Millisecond),
+		sessionStart: banTime,
+		lastSeen:     banTime,
+	}
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(2, s.filter.logged[pubKey].banLevel)
+}
+
+func (s *LoginFilterTestSuite) TestBanLevelResetsAfterQuietPeriodFollowingBan() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	quiet := 2*s.filter.cfg.baseBlockDuration + time.Second
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:  meta,
+		banLevel:     2,
+		banExpiresAt: time.Now().Add(-s.filter.cfg.baseBlockDuration),
+		lastSeen:     time.Now().Add(-2 * quiet),
+	}
+
+	s.filter.addLogin(pubKey, meta)
+	s.Equal(2, s.filter.logged[pubKey].banLevel, "ban ended more recently than the quiet period")
+
+	s.filter.logged[pubKey].banExpiresAt = time.Now().Add(-quiet)
+	s.filter.logged[pubKey].lastSeen = time.Now().Add(-2 * quiet)
+
+	s.filter.addLogin(pubKey, meta)
+	s.Equal(0, s.filter.logged[pubKey].banLevel)
+}
+
+func (s *LoginFilterTestSuite) TestBanDurationIsCappedAtMaxLevel() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+	maxLevel := s.filter.cfg.maxBanLevel
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:  meta,
+		banLevel:     maxLevel,
+		sessionStart: time.Now(),
+		lastSeen:     time.Now(),
+	}
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(maxLevel, s.filter.logged[pubKey].banLevel)
+	expected := s.filter.cfg.baseBlockDuration << (maxLevel - 1)
+	s.InDelta(expected, s.filter.logged[pubKey].banExpiresAt.Sub(s.filter.logged[pubKey].lastSeen), float64(time.Millisecond))
+}
+
+func (s *LoginFilterTestSuite) TestEstablishedPeerReconnectingOnceIsAllowed() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	longAgo := time.Now().Add(-time.Hour)
+
+	s.filter.logged[pubKey] = &peerState{
+		currentHash:           meta,
+		sessionCounter:        1,
+		sessionStart:          longAgo,
+		lastSeen:              longAgo,
+		metaChangeWindowStart: longAgo,
+		metaChangeCounter:     1,
+	}
+
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.filter.addLogin(pubKey, meta)
+
+	s.True(s.filter.allowLogin(pubKey, meta))
+	s.False(s.filter.logged[pubKey].isBanned)
+	s.Equal(1, s.filter.logged[pubKey].sessionCounter)
+}
+
+func (s *LoginFilterTestSuite) TestLoginsDuringActiveBanDoNotExtendIt() {
+	pubKey := "PUB_KEY_A"
+	meta := uint64(1)
+	limit := s.filter.cfg.reconnLimitForBan
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+	s.Require().Contains(s.filter.logged, pubKey)
+	s.Require().True(s.filter.logged[pubKey].isBanned)
+	expiresAt := time.Now().Add(time.Hour)
+	s.filter.logged[pubKey].banExpiresAt = expiresAt
+	lastSeen := s.filter.logged[pubKey].lastSeen
+
+	for i := 0; i <= limit; i++ {
+		s.filter.addLogin(pubKey, meta)
+	}
+
+	s.True(s.filter.logged[pubKey].isBanned)
+	s.Equal(1, s.filter.logged[pubKey].banLevel)
+	s.Equal(expiresAt, s.filter.logged[pubKey].banExpiresAt)
+	s.Equal(lastSeen, s.filter.logged[pubKey].lastSeen)
+	s.Equal(0, s.filter.logged[pubKey].sessionCounter)
+}
+
 func BenchmarkHashingMethods(b *testing.B) {
 	meta := nbpeer.PeerSystemMeta{
 		WtVersion:          "1.25.1",

management/internals/shared/grpc/pkce_flow_test.go

@@ -0,0 +1,87 @@
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/client/common"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestApplySessionExtendFlowPolicy(t *testing.T) {
+	tests := []struct {
+		name               string
+		flow               *proto.PKCEAuthorizationFlow
+		sessionExtend      bool
+		disablePromptLogin bool
+		loginFlag          uint32
+	}{
+		{
+			name: "extend replaces max_age=0 so login_hint is honoured",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend replaces the none flag so the extend is not silent",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagNone),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend respects DisablePromptLogin",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: true,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: true,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+		{
+			name: "login keeps the configured flow untouched",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      false,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			applySessionExtendFlowPolicy(tc.flow, tc.sessionExtend)
+			cfg := tc.flow.GetProviderConfig()
+			assert.Equal(t, tc.disablePromptLogin, cfg.GetDisablePromptLogin())
+			assert.Equal(t, tc.loginFlag, cfg.GetLoginFlag())
+		})
+	}
+}
+
+// A provider config is not guaranteed to be present on the response; clearing
+// the flag must not panic when the validator returned an empty flow.
+func TestApplySessionExtendFlowPolicyWithoutProviderConfig(t *testing.T) {
+	assert.NotPanics(t, func() {
+		applySessionExtendFlowPolicy(&proto.PKCEAuthorizationFlow{}, true)
+		applySessionExtendFlowPolicy(nil, true)
+	})
+}

management/internals/shared/grpc/pkce_verifier.go

@@ -1,55 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"github.com/eko/gocache/lib/v4/store"
-	log "github.com/sirupsen/logrus"
-
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
-)
-
-// PKCEVerifierStore manages PKCE verifiers for OAuth flows.
-// Supports both in-memory and Redis storage via NB_IDP_CACHE_REDIS_ADDRESS env var.
-type PKCEVerifierStore struct {
-	cache nbcache.Store
-	ctx   context.Context
-}
-
-// NewPKCEVerifierStore creates a PKCE verifier store using the provided shared cache store.
-func NewPKCEVerifierStore(ctx context.Context, cacheStore nbcache.Store) *PKCEVerifierStore {
-	return &PKCEVerifierStore{
-		cache: cacheStore,
-		ctx:   ctx,
-	}
-}
-
-// Store saves a PKCE verifier associated with an OAuth state parameter.
-// The verifier is stored with the specified TTL and will be automatically deleted after expiration.
-func (s *PKCEVerifierStore) Store(state, verifier string, ttl time.Duration) error {
-	if err := s.cache.Set(s.ctx, state, verifier, store.WithExpiration(ttl)); err != nil {
-		return fmt.Errorf("failed to store PKCE verifier: %w", err)
-	}
-
-	log.Debugf("Stored PKCE verifier for state (expires in %s)", ttl)
-	return nil
-}
-
-// LoadAndDelete retrieves and removes a PKCE verifier for the given state.
-// Returns the verifier and true if found, or empty string and false if not found.
-// This enforces single-use semantics for PKCE verifiers.
-func (s *PKCEVerifierStore) LoadAndDelete(state string) (string, bool) {
-	verifier, found, err := s.cache.GetDel(s.ctx, state)
-	if err != nil {
-		log.Warnf("Failed to consume PKCE verifier: %v", err)
-		return "", false
-	}
-	if !found {
-		log.Debug("PKCE verifier not found for state")
-		return "", false
-	}
-
-	return verifier, true
-}

management/internals/shared/grpc/proxy.go

@@ -27,8 +27,6 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/shared/management/domain"
-
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
@@ -42,6 +40,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
 	"github.com/netbirdio/netbird/shared/hash/argon2id"
+	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	nbstatus "github.com/netbirdio/netbird/shared/management/status"
 )
@@ -142,8 +141,8 @@ type ProxyServiceServer struct {
 	// OIDC configuration for proxy authentication
 	oidcConfig ProxyOIDCConfig
 
-	// Store for PKCE verifiers
-	pkceVerifierStore *PKCEVerifierStore
+	// singleUseStore backs both PKCE verifiers and OIDC session exchange codes.
+	singleUseStore *SingleUseStore
 
 	// tokenTTL is the lifetime of one-time tokens generated for proxy
 	// authentication. Defaults to defaultProxyTokenTTL when zero.
@@ -158,6 +157,13 @@ type ProxyServiceServer struct {
 
 const pkceVerifierTTL = 10 * time.Minute
 
+const sessionCodeTTL = 60 * time.Second
+
+const sessionCodeCacheNamespace = "proxy:session"
+
+// The signed nonce binds the handoff mode without changing the state format.
+const sessionCodeNoncePrefix = "code."
+
 const defaultProxyTokenTTL = 5 * time.Minute
 
 const defaultSnapshotBatchSize = 500
@@ -208,13 +214,13 @@ func enforceAccountScope(ctx context.Context, requestAccountID string) error {
 }
 
 // NewProxyServiceServer creates a new proxy service server.
-func NewProxyServiceServer(accessLogMgr accesslogs.Manager, tokenStore *OneTimeTokenStore, pkceStore *PKCEVerifierStore, oidcConfig ProxyOIDCConfig, peersManager peers.Manager, usersManager users.Manager, idpManager idp.Manager, proxyMgr proxy.Manager, tokenChecker ProxyTokenChecker) *ProxyServiceServer {
+func NewProxyServiceServer(accessLogMgr accesslogs.Manager, tokenStore *OneTimeTokenStore, singleUseStore *SingleUseStore, oidcConfig ProxyOIDCConfig, peersManager peers.Manager, usersManager users.Manager, idpManager idp.Manager, proxyMgr proxy.Manager, tokenChecker ProxyTokenChecker) *ProxyServiceServer {
 	ctx, cancel := context.WithCancel(context.Background())
 	s := &ProxyServiceServer{
 		accessLogManager:  accessLogMgr,
 		oidcConfig:        oidcConfig,
 		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		singleUseStore:    singleUseStore,
 		peersManager:      peersManager,
 		usersManager:      usersManager,
 		idpManager:        idpManager,
@@ -306,6 +312,16 @@ func (s *ProxyServiceServer) proxyConnectAuthorizer() ProxyConnectAuthorizer {
 	return s.connectAuthorizer
 }
 
+// GenerateSessionCode creates a single-use code for the given session token.
+func (s *ProxyServiceServer) GenerateSessionCode(sessionToken string) (code string, ok bool) {
+	code, err := s.singleUseStore.Generate(sessionCodeCacheNamespace, sessionToken, sessionCodeTTL)
+	if err != nil {
+		log.WithError(err).Error("failed to generate proxy session code")
+		return "", false
+	}
+	return code, true
+}
+
 // CheckLLMPolicyLimits is the pre-flight policy gate the proxy calls before
 // forwarding an LLM request upstream. Delegates to the agent-network selector,
 // which scores applicable policies by remaining headroom and returns the
@@ -1536,18 +1552,20 @@ func (s *ProxyServiceServer) GetOIDCURL(ctx context.Context, req *proto.GetOIDCU
 		log.WithContext(ctx).Errorf("failed to get account services: %v", err)
 		return nil, status.Errorf(codes.FailedPrecondition, "get account services: %v", err)
 	}
-	var found bool
+	var matchedService *rpservice.Service
 	for _, service := range services {
 		if service.Domain == redirectURL.Hostname() {
-			found = true
+			matchedService = service
 			break
 		}
 	}
-	if !found {
+	if matchedService == nil {
 		log.WithContext(ctx).Debugf("OIDC redirect URL %q does not match any service domain", redirectURL.Hostname())
 		return nil, status.Errorf(codes.FailedPrecondition, "service not found in store")
 	}
 
+	useSessionCode := s.proxyManager.ClusterSupportsSessionCode(ctx, matchedService.ProxyCluster)
+
 	provider, err := oidc.NewProvider(ctx, s.oidcConfig.Issuer)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to create OIDC provider: %v", err)
@@ -1567,15 +1585,18 @@ func (s *ProxyServiceServer) GetOIDCURL(ctx context.Context, req *proto.GetOIDCU
 		return nil, status.Errorf(codes.Internal, "generate nonce: %v", err)
 	}
 	nonceB64 := base64.URLEncoding.EncodeToString(nonce)
+	if useSessionCode {
+		nonceB64 = sessionCodeNoncePrefix + nonceB64
+	}
 
 	// Using an HMAC here to avoid redirection state being modified.
-	// State format: base64(redirectURL)|nonce|hmac(redirectURL|nonce)
+	// State format: base64(redirectURL)|[code.]nonce|hmac(redirectURL|nonce)
 	payload := redirectURL.String() + "|" + nonceB64
 	hmacSum := s.generateHMAC(payload)
 	state := fmt.Sprintf("%s|%s|%s", base64.URLEncoding.EncodeToString([]byte(redirectURL.String())), nonceB64, hmacSum)
 
 	codeVerifier := oauth2.GenerateVerifier()
-	if err := s.pkceVerifierStore.Store(state, codeVerifier, pkceVerifierTTL); err != nil {
+	if err := s.singleUseStore.Store(state, codeVerifier, pkceVerifierTTL); err != nil {
 		log.WithContext(ctx).Errorf("failed to store PKCE verifier: %v", err)
 		return nil, status.Errorf(codes.Internal, "store PKCE verifier: %v", err)
 	}
@@ -1612,15 +1633,12 @@ func (s *ProxyServiceServer) generateHMAC(input string) string {
 	return hex.EncodeToString(mac.Sum(nil))
 }
 
-// ValidateState validates the state parameter from an OAuth callback.
-// Returns the original redirect URL if valid, or an error if invalid.
-// The HMAC is verified before consuming the PKCE verifier to prevent
-// an attacker from invalidating a legitimate user's auth flow.
-func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL string, err error) {
-	// State format: base64(redirectURL)|nonce|hmac(redirectURL|nonce)
+// ValidateState validates and consumes an OIDC state.
+func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL string, useSessionCode bool, err error) {
+	// State format: base64(redirectURL)|[code.]nonce|hmac(redirectURL|nonce)
 	parts := strings.Split(state, "|")
 	if len(parts) != 3 {
-		return "", "", errors.New("invalid state format")
+		return "", "", false, errors.New("invalid state format")
 	}
 
 	encodedURL := parts[0]
@@ -1629,7 +1647,7 @@ func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL
 
 	redirectURLBytes, err := base64.URLEncoding.DecodeString(encodedURL)
 	if err != nil {
-		return "", "", fmt.Errorf("invalid state encoding: %w", err)
+		return "", "", false, fmt.Errorf("invalid state encoding: %w", err)
 	}
 	redirectURL = string(redirectURLBytes)
 
@@ -1637,16 +1655,17 @@ func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL
 	expectedHMAC := s.generateHMAC(payload)
 
 	if !hmac.Equal([]byte(providedHMAC), []byte(expectedHMAC)) {
-		return "", "", errors.New("invalid state signature")
+		return "", "", false, errors.New("invalid state signature")
 	}
+	useSessionCode = strings.HasPrefix(nonce, sessionCodeNoncePrefix)
 
 	// Consume the PKCE verifier only after HMAC validation passes.
-	verifier, ok := s.pkceVerifierStore.LoadAndDelete(state)
+	verifier, ok := s.singleUseStore.LoadAndDelete(state)
 	if !ok {
-		return "", "", errors.New("no verifier for state")
+		return "", "", false, errors.New("no verifier for state")
 	}
 
-	return verifier, redirectURL, nil
+	return verifier, redirectURL, useSessionCode, nil
 }
 
 // Denied reasons reported to the proxy when access is refused because of the
@@ -1704,6 +1723,40 @@ func sameAccount(userAccountID, serviceAccountID string) bool {
 	return userAccountID != "" && serviceAccountID != "" && userAccountID == serviceAccountID
 }
 
+// resolveUserEmail returns the user's stored email, else the email claim of
+// an already validated session token, else the IdP's email. The claim was
+// resolved the same way when the token was signed, so reusing it saves the
+// IdP round-trip on every validation. An IdP failure yields an empty string.
+func (s *ProxyServiceServer) resolveUserEmail(ctx context.Context, accountID string, user *types.User, tokenEmail string) string {
+	if user.Email != "" {
+		return user.Email
+	}
+	if tokenEmail != "" {
+		return tokenEmail
+	}
+	return s.idpEmail(ctx, accountID, user.Id)
+}
+
+// idpEmail looks up a user's email at the IdP, scoped to the given account.
+// It returns an empty string when no IdP is configured, the lookup fails or
+// the IdP knows no email for the user.
+func (s *ProxyServiceServer) idpEmail(ctx context.Context, accountID, userID string) string {
+	if s.idpManager == nil {
+		return ""
+	}
+
+	userData, err := s.idpManager.GetUserDataByID(ctx, userID, idp.AppMetadata{WTAccountID: accountID})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{"user_id": userID, "error": err.Error()}).Debug("IdP email lookup failed; using stored identity")
+		return ""
+	}
+	if userData == nil {
+		return ""
+	}
+
+	return userData.Email
+}
+
 // GenerateSessionToken creates a signed session JWT for the given domain and
 // user. The user's group memberships are embedded in the token so policy-aware
 // middlewares on the proxy can authorise without an extra management round-trip.
@@ -1759,7 +1812,7 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 	token, err := sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
-		user.Email,
+		s.resolveUserEmail(ctx, service.AccountID, user, ""),
 		domain,
 		method,
 		groupIDs,
@@ -1851,7 +1904,20 @@ func (s *ProxyServiceServer) getAccountServiceByDomain(ctx context.Context, acco
 // ValidateSession validates a session token and checks if the user has access to the domain.
 func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.ValidateSessionRequest) (*proto.ValidateSessionResponse, error) {
 	domain := req.GetDomain()
-	sessionToken := req.GetSessionToken()
+	sessionToken := req.GetSessionToken() //nolint:staticcheck
+
+	// A one-time code from the OIDC callback is redeemed here for the durable
+	// token, so the token never travels in a redirect URL. The redeemed token
+	// is returned to the proxy (mintedToken) to install as the session cookie.
+	mintedToken := ""
+	if code := req.GetSessionCode(); code != "" {
+		redeemed, found := s.singleUseStore.LoadAndDelete(singleUseCacheKey(sessionCodeCacheNamespace, code))
+		if !found {
+			return deniedSessionResponse("invalid or expired session code"), nil
+		}
+		sessionToken = redeemed
+		mintedToken = redeemed
+	}
 
 	if domain == "" || sessionToken == "" {
 		return deniedSessionResponse("missing domain or session_token"), nil
@@ -1871,7 +1937,7 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 		return nil, err
 	}
 
-	userID, reason := sessionTokenSubject(domain, service, sessionToken)
+	userID, tokenEmail, reason := sessionTokenSubject(domain, service, sessionToken)
 	if reason != "" {
 		return deniedSessionResponse(reason), nil
 	}
@@ -1900,12 +1966,13 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	}
 
 	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
+	userEmail := s.resolveUserEmail(ctx, service.AccountID, user, tokenEmail)
 
 	if reason := s.accountUserDeniedReason(domain, service, user); reason != "" {
 		return &proto.ValidateSessionResponse{
 			Valid:          false,
 			UserId:         user.Id,
-			UserEmail:      user.Email,
+			UserEmail:      userEmail,
 			DeniedReason:   reason,
 			PeerGroupIds:   groupIDs,
 			PeerGroupNames: groupNames,
@@ -1915,15 +1982,16 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	log.WithFields(log.Fields{
 		"domain":  domain,
 		"user_id": userID,
-		"email":   user.Email,
+		"email":   userEmail,
 	}).Debug("ValidateSession: access granted")
 
 	return &proto.ValidateSessionResponse{
 		Valid:          true,
 		UserId:         user.Id,
-		UserEmail:      user.Email,
+		UserEmail:      userEmail,
 		PeerGroupIds:   groupIDs,
 		PeerGroupNames: groupNames,
+		SessionToken:   mintedToken,
 	}, nil
 }
 
@@ -1937,28 +2005,28 @@ func deniedSessionResponse(reason string) *proto.ValidateSessionResponse {
 }
 
 // sessionTokenSubject verifies the session token against the service's session
-// key and returns the user it was minted for, or the reason it cannot be
-// trusted.
-func sessionTokenSubject(domain string, service *rpservice.Service, sessionToken string) (userID, deniedReason string) {
+// key and returns the user and email it was minted for, or the reason it
+// cannot be trusted.
+func sessionTokenSubject(domain string, service *rpservice.Service, sessionToken string) (userID, email, deniedReason string) {
 	pubKeyBytes, err := base64.StdEncoding.DecodeString(service.SessionPublicKey)
 	if err != nil {
 		log.WithFields(log.Fields{
 			"domain": domain,
 			"error":  err.Error(),
 		}).Error("ValidateSession: decode public key")
-		return "", "invalid_service_config"
+		return "", "", "invalid_service_config"
 	}
 
-	userID, _, _, _, _, err = proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
+	userID, email, _, _, _, err = proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
 	if err != nil {
 		log.WithFields(log.Fields{
 			"domain": domain,
 			"error":  err.Error(),
 		}).Debug("ValidateSession: invalid session token")
-		return "", "invalid_token"
+		return "", "", "invalid_token"
 	}
 
-	return userID, ""
+	return userID, email, ""
 }
 
 // accountUserDeniedReason gates a user of the service's own account, returning
@@ -2239,12 +2307,8 @@ func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain strin
 	// IdP enrichment wins when available — the stored email column is a
 	// best-effort cache and is frequently empty for OIDC users. Enrichment
 	// failures must never fail the RPC; we simply keep the stored/peer identity.
-	if s.idpManager != nil {
-		if ud, uerr := s.idpManager.GetUserDataByID(ctx, peer.UserID, idp.AppMetadata{WTAccountID: service.AccountID}); uerr == nil && ud != nil && ud.Email != "" {
-			displayIdentity = ud.Email
-		} else if uerr != nil {
-			log.WithFields(log.Fields{"domain": domain, "user_id": peer.UserID, "error": uerr.Error()}).Debug("ValidateTunnelPeer: IdP user enrichment failed; using stored/peer identity")
-		}
+	if email := s.idpEmail(ctx, service.AccountID, peer.UserID); email != "" {
+		displayIdentity = email
 	}
 
 	return principalID, displayIdentity

management/internals/shared/grpc/proxy_test.go

@@ -129,11 +129,11 @@ func drainEmpty(ch chan *proto.GetMappingUpdateResponse) bool {
 func TestSendServiceUpdateToCluster_UniqueTokensPerProxy(t *testing.T) {
 	ctx := context.Background()
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
-		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		tokenStore:     tokenStore,
+		singleUseStore: singleUseStore,
 	}
 	s.SetProxyController(newTestProxyController())
 
@@ -186,11 +186,11 @@ func TestSendServiceUpdateToCluster_UniqueTokensPerProxy(t *testing.T) {
 func TestSendServiceUpdateToCluster_DeleteNoToken(t *testing.T) {
 	ctx := context.Background()
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
-		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		tokenStore:     tokenStore,
+		singleUseStore: singleUseStore,
 	}
 	s.SetProxyController(newTestProxyController())
 
@@ -220,11 +220,11 @@ func TestSendServiceUpdateToCluster_DeleteNoToken(t *testing.T) {
 func TestSendServiceUpdate_UniqueTokensPerProxy(t *testing.T) {
 	ctx := context.Background()
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
-		tokenStore:        tokenStore,
-		pkceVerifierStore: pkceStore,
+		tokenStore:     tokenStore,
+		singleUseStore: singleUseStore,
 	}
 	s.SetProxyController(newTestProxyController())
 
@@ -272,13 +272,13 @@ func generateState(s *ProxyServiceServer, redirectURL string) string {
 
 func TestOAuthState_NeverTheSame(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
 			HMACKey: []byte("test-hmac-key"),
 		},
-		pkceVerifierStore: pkceStore,
+		singleUseStore: singleUseStore,
 	}
 
 	redirectURL := "https://app.example.com/callback"
@@ -300,20 +300,20 @@ func TestOAuthState_NeverTheSame(t *testing.T) {
 
 func TestValidateState_RejectsOldTwoPartFormat(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
 			HMACKey: []byte("test-hmac-key"),
 		},
-		pkceVerifierStore: pkceStore,
+		singleUseStore: singleUseStore,
 	}
 
 	// Old format had only 2 parts: base64(url)|hmac
-	err := s.pkceVerifierStore.Store("base64url|hmac", "test", 10*time.Minute)
+	err := s.singleUseStore.Store("base64url|hmac", "test", 10*time.Minute)
 	require.NoError(t, err)
 
-	_, _, err = s.ValidateState("base64url|hmac")
+	_, _, _, err = s.ValidateState("base64url|hmac")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid state format")
 }
@@ -372,24 +372,48 @@ func TestEnforceAccountScope_AllowsNoTokenInContext(t *testing.T) {
 
 func TestValidateState_RejectsInvalidHMAC(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
 			HMACKey: []byte("test-hmac-key"),
 		},
-		pkceVerifierStore: pkceStore,
+		singleUseStore: singleUseStore,
 	}
 
 	// Store with tampered HMAC
-	err := s.pkceVerifierStore.Store("dGVzdA==|nonce|wrong-hmac", "test", 10*time.Minute)
+	err := s.singleUseStore.Store("dGVzdA==|nonce|wrong-hmac", "test", 10*time.Minute)
 	require.NoError(t, err)
 
-	_, _, err = s.ValidateState("dGVzdA==|nonce|wrong-hmac")
+	_, _, _, err = s.ValidateState("dGVzdA==|nonce|wrong-hmac")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid state signature")
 }
 
+func TestSessionCodeCannotConsumeOIDCState(t *testing.T) {
+	const verifier = "pkce-verifier"
+
+	store := NewSingleUseStore(context.Background(), testCacheStore(t))
+	server := &ProxyServiceServer{
+		oidcConfig: ProxyOIDCConfig{
+			HMACKey: []byte("test-hmac-key"),
+		},
+		singleUseStore: store,
+	}
+	state := generateState(server, "https://service.example.com/callback")
+	require.NoError(t, store.Store(state, verifier, time.Minute))
+
+	response, err := server.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		SessionCode: state,
+	})
+	require.NoError(t, err)
+	assert.False(t, response.GetValid())
+
+	gotVerifier, _, _, err := server.ValidateState(state)
+	require.NoError(t, err)
+	assert.Equal(t, verifier, gotVerifier)
+}
+
 func TestSendServiceUpdateToCluster_FiltersOnCapability(t *testing.T) {
 	tokenStore := NewOneTimeTokenStore(context.Background(), testCacheStore(t))
 

management/internals/shared/grpc/server.go

@@ -313,7 +313,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while sending initial sync for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
-		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart)
+		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart, nil)
 		return err
 	}
 
@@ -321,7 +321,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 	if err != nil {
 		log.WithContext(ctx).Debugf("error while notify peer connected for %s: %v", peerKey.String(), err)
 		s.syncSem.Add(-1)
-		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart)
+		s.cancelPeerRoutinesWithoutLock(ctx, accountID, peer, syncStart, nil)
 		return err
 	}
 
@@ -337,7 +337,7 @@ func (s *Server) Sync(req *proto.EncryptedMessage, srv proto.ManagementService_S
 
 	s.syncSem.Add(-1)
 
-	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart) }).
+	return PeerUpdateHandlerFactory(peerKey, updates, s.secretsManager, srv, func() { s.cancelPeerRoutines(ctx, accountID, peer, syncStart, updates) }).
 		WithMetrics(s.appMetrics).HandleUpdates(ctx)
 }
 
@@ -383,7 +383,7 @@ func (s *Server) startResponseReceiver(ctx context.Context, srv proto.Management
 
 func (s *Server) sendJobsLoop(ctx context.Context, accountID string, peerKey wgtypes.Key, peer *nbpeer.Peer, updates *job.Channel, srv proto.ManagementService_JobServer) error {
 	// todo figure out better error handling strategy
-	defer s.jobManager.CloseChannel(ctx, accountID, peer.ID)
+	defer s.jobManager.CloseChannel(ctx, accountID, peer.ID, updates)
 
 	for {
 		event, err := updates.Event(ctx)
@@ -430,20 +430,26 @@ func (s *Server) sendJob(ctx context.Context, peerKey wgtypes.Key, job *job.Even
 	return nil
 }
 
-func (s *Server) cancelPeerRoutines(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time) {
+func (s *Server) cancelPeerRoutines(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time, session chan *network_map.UpdateMessage) {
 	uncanceledCTX := context.WithoutCancel(ctx)
 	unlock := s.acquirePeerLockByUID(uncanceledCTX, peer.Key)
 	defer unlock()
 
-	s.cancelPeerRoutinesWithoutLock(uncanceledCTX, accountID, peer, streamStartTime)
+	s.cancelPeerRoutinesWithoutLock(uncanceledCTX, accountID, peer, streamStartTime, session)
 }
 
-func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time) {
+// cancelPeerRoutinesWithoutLock tears down the stream of the session identified by streamStartTime
+// and its updates channel. A nil session means the stream failed before it registered a channel;
+// the controller then closes any channel still registered.
+func (s *Server) cancelPeerRoutinesWithoutLock(ctx context.Context, accountID string, peer *nbpeer.Peer, streamStartTime time.Time, session chan *network_map.UpdateMessage) {
 	err := s.accountManager.OnPeerDisconnected(ctx, accountID, peer.Key, streamStartTime)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to disconnect peer %s properly: %v", peer.Key, err)
 	}
-	s.networkMapController.OnPeerDisconnected(ctx, accountID, peer.ID)
+	if !s.networkMapController.OnPeerDisconnected(ctx, accountID, peer.ID, session) {
+		log.WithContext(ctx).Debugf("skipped peer routines teardown for %s: a newer session owns the peer", peer.Key)
+		return
+	}
 	s.secretsManager.CancelRefresh(peer.ID)
 
 	log.WithContext(ctx).Debugf("peer %s has been disconnected", peer.Key)
@@ -955,12 +961,12 @@ func (s *Server) sendInitialSync(ctx context.Context, peerKey wgtypes.Key, peer
 		// stops doing duplicate work. Deferred until the client-side
 		// decoder lands and there's a real deployment of capability=3 peers
 		// worth optimizing for.
-		freshPeer, components, proxyPatch, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
+		freshPeer, components, freshPostureChecks, freshDnsFwdPort, err := s.networkMapController.GetValidatedPeerWithComponents(ctx, false, peer.AccountID, peer)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to build components for peer %s on initial sync: %v", peer.ID, err)
 			return status.Errorf(codes.Internal, "failed to build initial sync envelope")
 		}
-		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, proxyPatch, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort, s.config.DebugUpload.URL)
+		plainResp = ToComponentSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(freshPeer), turnToken, relayToken, components, dnsName, freshPostureChecks, types.TwinAccountSettings(settings), settings.Extra, peerGroups, freshDnsFwdPort, s.config.DebugUpload.URL)
 	} else {
 		plainResp = ToSyncResponse(ctx, s.config, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, types.TwinPeer(peer), turnToken, relayToken, networkMap, dnsName, postureChecks, nil, types.TwinAccountSettings(settings), settings.Extra, peerGroups, dnsFwdPort, s.config.DebugUpload.URL)
 	}
@@ -1088,7 +1094,8 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 		return nil, status.Errorf(codes.Internal, "failed to get server key")
 	}
 
-	err = encryption.DecryptMessage(peerKey, key, req.Body, &proto.PKCEAuthorizationFlowRequest{})
+	flowReq := &proto.PKCEAuthorizationFlowRequest{}
+	err = encryption.DecryptMessage(peerKey, key, req.Body, flowReq)
 	if err != nil {
 		errMSG := fmt.Sprintf("error while decrypting peer's message with Wireguard public key %s.", req.WgPubKey)
 		log.WithContext(ctx).Warn(errMSG)
@@ -1132,6 +1139,7 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}
 
 	flowInfoResp := s.integratedPeerValidator.ValidateFlowResponse(ctx, peerKey.String(), initInfoFlow)
+	applySessionExtendFlowPolicy(flowInfoResp, flowReq.GetSessionExtend())
 
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, flowInfoResp)
 	if err != nil {
@@ -1144,6 +1152,40 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}, nil
 }
 
+// applySessionExtendFlowPolicy forces a prompt=login flow for a session extend.
+//
+// An extend renews the session of one specific peer, so its token has to come
+// from the account that peer is registered under. A flow that does not prompt
+// leaves the choice to the IdP, which answers a silent authorization from any
+// session it already holds — not necessarily this peer's account when several
+// are signed in, and login_hint is a suggestion the IdP may ignore. The token
+// then fails the jwt.UserID == peer.UserID check in ExtendAuthSession, and the
+// user is given no opportunity to pick a different account.
+//
+// LoginFlagPromptLogin rather than max_age=0: both re-authenticate, but with
+// prompt=login the IdP honours login_hint and offers the peer's own account,
+// whereas max_age=0 leaves the user to find it among every account signed in.
+//
+// DisablePromptLogin is left alone. It is set for IdPs that break on
+// prompt=login — Authentik triggers a double authentication, and social logins
+// fail outright — so overriding it would trade a recoverable session extend for
+// a login that cannot complete at all. Those deployments keep the silent flow
+// and, with several accounts signed in, an extend answered from the wrong one
+// still fails the user match.
+//
+// Called after ValidateFlowResponse so that a per-peer override cannot reinstate
+// the silent flow for an extend.
+func applySessionExtendFlowPolicy(flow *proto.PKCEAuthorizationFlow, sessionExtend bool) {
+	if !sessionExtend {
+		return
+	}
+	cfg := flow.GetProviderConfig()
+	if cfg == nil || cfg.GetDisablePromptLogin() {
+		return
+	}
+	cfg.LoginFlag = uint32(common.LoginFlagPromptLogin)
+}
+
 // SyncMeta endpoint is used to synchronize peer's system metadata and notifies the connected,
 // peer's under the same account of any updates.
 func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*proto.Empty, error) {

management/internals/shared/grpc/server_disconnect_test.go

@@ -0,0 +1,48 @@
+package grpc
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+)
+
+func TestCancelPeerRoutines_SessionOwnership(t *testing.T) {
+	peer := &nbpeer.Peer{ID: "peer-1", Key: "peer-key"}
+	streamStart := time.Unix(1700000000, 0)
+	session := make(chan *network_map.UpdateMessage)
+
+	tests := []struct {
+		name          string
+		session       chan *network_map.UpdateMessage
+		ownsPeer      bool
+		cancelRefresh bool
+	}{
+		{name: "owning session tears everything down", session: session, ownsPeer: true, cancelRefresh: true},
+		{name: "stale session keeps the newer session's refresh", session: session, ownsPeer: false, cancelRefresh: false},
+		{name: "failed sync without a channel closes the older session", session: nil, ownsPeer: true, cancelRefresh: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			accountManager := account.NewMockManager(ctrl)
+			controller := network_map.NewMockController(ctrl)
+			secretsManager := NewMockSecretsManager(ctrl)
+			s := &Server{accountManager: accountManager, networkMapController: controller, secretsManager: secretsManager}
+
+			accountManager.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.Key, streamStart).Return(nil)
+			controller.EXPECT().OnPeerDisconnected(gomock.Any(), "account-1", peer.ID, tt.session).Return(tt.ownsPeer)
+			if tt.cancelRefresh {
+				secretsManager.EXPECT().CancelRefresh(peer.ID)
+			}
+
+			s.cancelPeerRoutines(context.Background(), "account-1", peer, streamStart, tt.session)
+		})
+	}
+}

management/internals/shared/grpc/single_use.go

@@ -0,0 +1,67 @@
+package grpc
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	log "github.com/sirupsen/logrus"
+
+	nbcache "github.com/netbirdio/netbird/management/server/cache"
+)
+
+// SingleUseStore stores short-lived values that can be retrieved only once.
+type SingleUseStore struct {
+	cache nbcache.Store
+	ctx   context.Context
+}
+
+// NewSingleUseStore creates a single-use value store over the shared cache.
+func NewSingleUseStore(ctx context.Context, cacheStore nbcache.Store) *SingleUseStore {
+	return &SingleUseStore{
+		cache: cacheStore,
+		ctx:   ctx,
+	}
+}
+
+// Store saves value under key with the given TTL, after which it is evicted.
+func (s *SingleUseStore) Store(key, value string, ttl time.Duration) error {
+	if err := s.cache.Set(s.ctx, key, value, store.WithExpiration(ttl)); err != nil {
+		return fmt.Errorf("store single-use value: %w", err)
+	}
+	return nil
+}
+
+// Generate stores a value under a namespaced random key and returns the random key.
+func (s *SingleUseStore) Generate(namespace, value string, ttl time.Duration) (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", fmt.Errorf("generate single-use key: %w", err)
+	}
+
+	key := base64.RawURLEncoding.EncodeToString(buf)
+	if err := s.Store(singleUseCacheKey(namespace, key), value, ttl); err != nil {
+		return "", err
+	}
+	return key, nil
+}
+
+func singleUseCacheKey(namespace, key string) string {
+	return namespace + ":" + key
+}
+
+// LoadAndDelete retrieves and removes the value for a key.
+func (s *SingleUseStore) LoadAndDelete(key string) (string, bool) {
+	value, found, err := s.cache.GetDel(s.ctx, key)
+	if err != nil {
+		log.Warnf("failed to consume single-use value: %v", err)
+		return "", false
+	}
+	if !found {
+		return "", false
+	}
+	return value, true
+}

management/internals/shared/grpc/single_use_test.go

@@ -6,7 +6,7 @@ import (
 	"time"
 )
 
-func TestPKCEVerifierStoreLoadAndDelete(t *testing.T) {
+func TestSingleUseStoreLoadAndDelete(t *testing.T) {
 	const (
 		state    = "state"
 		verifier = "verifier"
@@ -14,7 +14,7 @@ func TestPKCEVerifierStoreLoadAndDelete(t *testing.T) {
 	)
 
 	t.Run("exactly one concurrent caller consumes the verifier", func(t *testing.T) {
-		store := NewPKCEVerifierStore(context.Background(), testCacheStore(t))
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
 		if err := store.Store(state, verifier, time.Minute); err != nil {
 			t.Fatalf("couldn't store PKCE verifier: %s", err)
 		}
@@ -50,7 +50,7 @@ func TestPKCEVerifierStoreLoadAndDelete(t *testing.T) {
 	})
 
 	t.Run("replayed state is rejected", func(t *testing.T) {
-		store := NewPKCEVerifierStore(context.Background(), testCacheStore(t))
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
 		if err := store.Store(state, verifier, time.Minute); err != nil {
 			t.Fatalf("couldn't store PKCE verifier: %s", err)
 		}
@@ -64,7 +64,7 @@ func TestPKCEVerifierStoreLoadAndDelete(t *testing.T) {
 	})
 
 	t.Run("unknown state is rejected", func(t *testing.T) {
-		store := NewPKCEVerifierStore(context.Background(), testCacheStore(t))
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
 
 		if got, found := store.LoadAndDelete("never-stored"); found {
 			t.Fatalf("unknown state should not resolve, got %q", got)
@@ -72,7 +72,7 @@ func TestPKCEVerifierStoreLoadAndDelete(t *testing.T) {
 	})
 
 	t.Run("expired verifier is rejected", func(t *testing.T) {
-		store := NewPKCEVerifierStore(context.Background(), testCacheStore(t))
+		store := NewSingleUseStore(context.Background(), testCacheStore(t))
 		if err := store.Store(state, verifier, 50*time.Millisecond); err != nil {
 			t.Fatalf("couldn't store PKCE verifier: %s", err)
 		}
@@ -83,3 +83,40 @@ func TestPKCEVerifierStoreLoadAndDelete(t *testing.T) {
 		}
 	})
 }
+
+func TestSingleUseStore_GenerateAndConsumeOnce(t *testing.T) {
+	const namespace = "test"
+	s := NewSingleUseStore(context.Background(), testCacheStore(t))
+
+	key, err := s.Generate(namespace, "the-value", time.Minute)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	if key == "" || key == "the-value" {
+		t.Fatalf("unexpected key %q", key)
+	}
+
+	value, found := s.LoadAndDelete(singleUseCacheKey(namespace, key))
+	if !found || value != "the-value" {
+		t.Fatalf("expected to load the stored value, got %q found=%v", value, found)
+	}
+
+	if _, found := s.LoadAndDelete(singleUseCacheKey(namespace, key)); found {
+		t.Fatal("value must be consumed on first LoadAndDelete")
+	}
+}
+
+func TestSingleUseStore_GenerateUniqueKeys(t *testing.T) {
+	s := NewSingleUseStore(context.Background(), testCacheStore(t))
+	a, err := s.Generate("test", "v", time.Minute)
+	if err != nil {
+		t.Fatalf("generate a: %v", err)
+	}
+	b, err := s.Generate("test", "v", time.Minute)
+	if err != nil {
+		t.Fatalf("generate b: %v", err)
+	}
+	if a == b {
+		t.Fatal("generated keys must be distinct")
+	}
+}

management/internals/shared/grpc/validate_session_test.go

@@ -1,5 +1,3 @@
-//go:build integration
-
 package grpc
 
 import (
@@ -7,6 +5,7 @@ import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/base64"
+	"errors"
 	"testing"
 	"time"
 
@@ -40,9 +39,9 @@ func setupValidateSessionTest(t *testing.T) *validateSessionTestSetup {
 	proxyManager := &testValidateSessionProxyManager{}
 
 	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	singleUseStore := NewSingleUseStore(ctx, testCacheStore(t))
 
-	proxyService := NewProxyServiceServer(nil, tokenStore, pkceStore, ProxyOIDCConfig{}, nil, usersManager, nil, proxyManager, nil)
+	proxyService := NewProxyServiceServer(nil, tokenStore, singleUseStore, ProxyOIDCConfig{}, nil, usersManager, nil, proxyManager, nil)
 	proxyService.SetServiceManager(serviceManager)
 
 	createTestProxies(t, ctx, testStore)
@@ -179,7 +178,12 @@ func generateSessionKeyPair(t *testing.T) (string, string) {
 
 func createSessionToken(t *testing.T, privKeyB64, userID, domain string) string {
 	t.Helper()
-	token, err := sessionkey.SignToken(privKeyB64, userID, "", domain, auth.MethodOIDC, nil, nil, time.Hour)
+	return createSessionTokenWithEmail(t, privKeyB64, userID, "", domain)
+}
+
+func createSessionTokenWithEmail(t *testing.T, privKeyB64, userID, email, domain string) string {
+	t.Helper()
+	token, err := sessionkey.SignToken(privKeyB64, userID, email, domain, auth.MethodOIDC, nil, nil, time.Hour)
 	require.NoError(t, err)
 	return token
 }
@@ -195,7 +199,7 @@ func TestValidateSession_UserAllowed(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -216,7 +220,7 @@ func TestValidateSession_UserNotInAllowedGroup(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -240,7 +244,7 @@ func TestValidateSession_PendingApprovalUserDenied(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -265,7 +269,7 @@ func TestValidateSession_PendingApprovalUserInAllUsersGroupDenied(t *testing.T)
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "all-users-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -288,7 +292,7 @@ func TestValidateSession_BlockedUserDenied(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck
 	})
 
 	require.NoError(t, err)
@@ -312,7 +316,7 @@ func TestValidateSession_UserAllowedAfterApproval(t *testing.T) {
 	token := createSessionToken(t, proxy.SessionPrivateKey, pendingUserID, "restricted-proxy.example.com")
 	req := &proto.ValidateSessionRequest{
 		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	}
 
 	resp, err := setup.proxyService.ValidateSession(ctx, req)
@@ -345,7 +349,7 @@ func TestValidateSession_UserInDifferentAccount(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -364,7 +368,7 @@ func TestValidateSession_UserNotFound(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -383,7 +387,7 @@ func TestValidateSession_ProxyNotFound(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "unknown-proxy.example.com",
-		SessionToken: token,
+		SessionToken: token, //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -397,7 +401,7 @@ func TestValidateSession_InvalidToken(t *testing.T) {
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
 		Domain:       "test-proxy.example.com",
-		SessionToken: "invalid-token",
+		SessionToken: "invalid-token", //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -410,7 +414,7 @@ func TestValidateSession_MissingDomain(t *testing.T) {
 	defer setup.cleanup()
 
 	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
-		SessionToken: "some-token",
+		SessionToken: "some-token", //nolint:staticcheck,
 	})
 
 	require.NoError(t, err)
@@ -491,15 +495,15 @@ func (m *testValidateSessionServiceManager) GetAllServices(_ context.Context, _,
 }
 
 func (m *testValidateSessionServiceManager) GetService(_ context.Context, _, _, _ string) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) CreateService(_ context.Context, _, _ string, _ *service.Service) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) UpdateService(_ context.Context, _, _ string, _ *service.Service) (*service.Service, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) DeleteService(_ context.Context, _, _, _ string) error {
@@ -543,7 +547,7 @@ func (m *testValidateSessionServiceManager) GetServiceIDByTargetID(_ context.Con
 }
 
 func (m *testValidateSessionServiceManager) CreateServiceFromPeer(_ context.Context, _, _ string, _ *service.ExposeServiceRequest) (*service.ExposeServiceResponse, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionServiceManager) RenewServiceFromPeer(_ context.Context, _, _, _ string) error {
@@ -571,7 +575,7 @@ func (m *testValidateSessionServiceManager) DeleteAccountCluster(_ context.Conte
 type testValidateSessionProxyManager struct{}
 
 func (m *testValidateSessionProxyManager) Connect(_ context.Context, _, _, _, _, _ string, _ *string, _ *proxy.Capabilities) (*proxy.Proxy, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionProxyManager) Disconnect(_ context.Context, _, _ string) error {
@@ -603,7 +607,7 @@ func (m *testValidateSessionProxyManager) CleanupStale(_ context.Context, _ time
 }
 
 func (m *testValidateSessionProxyManager) GetAccountProxy(_ context.Context, _ string) (*proxy.Proxy, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil
 }
 
 func (m *testValidateSessionProxyManager) CountAccountProxies(_ context.Context, _ string) (int64, error) {
@@ -634,6 +638,14 @@ func (m *testValidateSessionProxyManager) ClusterSupportsPrivate(_ context.Conte
 	return nil
 }
 
+func (m *testValidateSessionProxyManager) ClusterAllProxiesPrivate(_ context.Context, _ string) *bool {
+	return nil
+}
+
+func (m *testValidateSessionProxyManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
+	return false
+}
+
 type testValidateSessionUsersManager struct {
 	store store.Store
 }
@@ -662,3 +674,169 @@ func (m *testValidateSessionUsersManager) GetUserWithGroups(ctx context.Context,
 	}
 	return user, groups, nil
 }
+
+func TestValidateSession_RedeemsSessionCode(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "testProxyId")
+	require.NoError(t, err)
+
+	token := createSessionToken(t, proxy.SessionPrivateKey, "allowedUserId", "test-proxy.example.com")
+	code, ok := setup.proxyService.GenerateSessionCode(token)
+	require.True(t, ok)
+	require.NotEqual(t, token, code, "code must not be the token itself")
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:      "test-proxy.example.com",
+		SessionCode: code,
+	})
+	require.NoError(t, err)
+	assert.True(t, resp.Valid, "redeemed code should authorize the user")
+	assert.Equal(t, "allowedUserId", resp.UserId)
+	assert.Equal(t, token, resp.GetSessionToken(), "response must carry the durable token for the cookie")
+
+	// Single-use: the same code must not redeem again.
+	resp2, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:      "test-proxy.example.com",
+		SessionCode: code,
+	})
+	require.NoError(t, err)
+	assert.False(t, resp2.Valid, "a consumed code must be rejected")
+	assert.Empty(t, resp2.GetSessionToken())
+}
+
+func TestValidateSession_InvalidSessionCode(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+		Domain:      "test-proxy.example.com",
+		SessionCode: "does-not-exist",
+	})
+	require.NoError(t, err)
+	assert.False(t, resp.Valid)
+	assert.Empty(t, resp.GetSessionToken())
+}
+
+// TestGenerateSessionToken_EmailFallsBackToIdP covers users whose stored email
+// column is empty: the token's email claim comes from the IdP so the proxy can
+// still stamp X-NetBird-User.
+func TestGenerateSessionToken_EmailFallsBackToIdP(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	idpMock := &mockTunnelIdpManager{email: "idp@example.com", hasData: true}
+	setup.proxyService.idpManager = idpMock
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	_, email, _, _, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "idp@example.com", email)
+	require.Len(t, idpMock.gotMeta, 1)
+	assert.Equal(t, "testAccountId", idpMock.gotMeta[0].WTAccountID, "IdP lookup must be scoped to the service's account")
+}
+
+// TestGenerateSessionToken_IdPFailureStillIssuesToken pins the fail-soft
+// behaviour: an unreachable IdP costs the email claim, not the login.
+func TestGenerateSessionToken_IdPFailureStillIssuesToken(t *testing.T) {
+	setup := setupValidateSessionTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+	svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
+	require.NoError(t, err)
+
+	setup.proxyService.idpManager = &mockTunnelIdpManager{err: errors.New("idp down")}
+
+	token, err := setup.proxyService.GenerateSessionToken(ctx, "restricted-proxy.example.com", "allowedUserId", auth.MethodOIDC)
+	require.NoError(t, err)
+
+	pubKey, err := base64.StdEncoding.DecodeString(svc.SessionPublicKey)
+	require.NoError(t, err)
+
+	userID, email, _, _, _, err := auth.ValidateSessionJWT(token, "restricted-proxy.example.com", pubKey)
+	require.NoError(t, err)
+	assert.Equal(t, "allowedUserId", userID)
+	assert.Empty(t, email)
+}
+
+func TestValidateSession_EmailResolution(t *testing.T) {
+	tests := []struct {
+		name        string
+		storedEmail string
+		tokenEmail  string
+		idp         *mockTunnelIdpManager
+		expectEmail string
+		expectCalls int
+	}{
+		{
+			name:        "stored email wins without IdP call",
+			storedEmail: "stored@example.com",
+			tokenEmail:  "claim@example.com",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "stored@example.com",
+		},
+		{
+			name:        "token email claim is reused without IdP call",
+			tokenEmail:  "claim@example.com",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "claim@example.com",
+		},
+		{
+			name:        "empty stored email and claim fall back to IdP",
+			idp:         &mockTunnelIdpManager{email: "idp@example.com", hasData: true},
+			expectEmail: "idp@example.com",
+			expectCalls: 1,
+		},
+		{
+			name:        "IdP error leaves email empty but session valid",
+			idp:         &mockTunnelIdpManager{err: errors.New("idp down")},
+			expectCalls: 1,
+		},
+		{
+			name:        "IdP without data leaves email empty",
+			idp:         &mockTunnelIdpManager{},
+			expectCalls: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupValidateSessionTest(t)
+			defer setup.cleanup()
+
+			ctx := context.Background()
+			user, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+			require.NoError(t, err)
+			user.Email = tt.storedEmail
+			require.NoError(t, setup.store.SaveUser(ctx, user))
+
+			setup.proxyService.idpManager = tt.idp
+
+			svc, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "testProxyId")
+			require.NoError(t, err)
+			token := createSessionTokenWithEmail(t, svc.SessionPrivateKey, "allowedUserId", tt.tokenEmail, "test-proxy.example.com")
+			code, ok := setup.proxyService.GenerateSessionCode(token)
+			require.True(t, ok)
+
+			resp, err := setup.proxyService.ValidateSession(ctx, &proto.ValidateSessionRequest{
+				Domain:      "test-proxy.example.com",
+				SessionCode: code,
+			})
+			require.NoError(t, err)
+			assert.True(t, resp.GetValid())
+			assert.Equal(t, tt.expectEmail, resp.GetUserEmail())
+			assert.Equal(t, tt.expectCalls, tt.idp.gotCalls)
+		})
+	}
+}

management/server/account.go

@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -84,7 +83,6 @@ type DefaultAccountManager struct {
 
 	requestBuffer *AccountRequestBuffer
 
-	proxyController port_forwarding.Controller
 	settingsManager settings.Manager
 	serviceManager  service.Manager
 
@@ -112,6 +110,9 @@ type DefaultAccountManager struct {
 	permissionsManager permissions.Manager
 
 	disableDefaultPolicy bool
+
+	deletionHooksMu sync.RWMutex
+	deletionHooks   []account.DeletionHook
 }
 
 var _ account.Manager = (*DefaultAccountManager)(nil)
@@ -120,6 +121,32 @@ func (am *DefaultAccountManager) SetServiceManager(serviceManager service.Manage
 	am.serviceManager = serviceManager
 }
 
+// AddAccountDeletionHook registers hook to run on every account deletion. Hooks run in
+// registration order, and the first one to fail stops the rest and aborts the deletion.
+// It panics on a nil hook: dropping one silently would skip that hook's cleanup on every
+// deletion, so the wiring bug surfaces at startup instead.
+func (am *DefaultAccountManager) AddAccountDeletionHook(hook account.DeletionHook) {
+	if hook == nil {
+		panic("nil account deletion hook")
+	}
+	am.deletionHooksMu.Lock()
+	defer am.deletionHooksMu.Unlock()
+	am.deletionHooks = append(am.deletionHooks, hook)
+}
+
+func (am *DefaultAccountManager) runAccountDeletionHooks(ctx context.Context, accountID string) error {
+	am.deletionHooksMu.RLock()
+	hooks := slices.Clone(am.deletionHooks)
+	am.deletionHooksMu.RUnlock()
+
+	for _, hook := range hooks {
+		if err := hook(ctx, accountID); err != nil {
+			return fmt.Errorf("account deletion hook: %w", err)
+		}
+	}
+	return nil
+}
+
 func isUniqueConstraintError(err error) bool {
 	switch {
 	case strings.Contains(err.Error(), "(SQLSTATE 23505)"),
@@ -196,7 +223,6 @@ func BuildManager(
 	userDeleteFromIDPEnabled bool,
 	integratedPeerValidator integrated_validator.IntegratedValidator,
 	metrics telemetry.AppMetrics,
-	proxyController port_forwarding.Controller,
 	settingsManager settings.Manager,
 	permissionsManager permissions.Manager,
 	disableDefaultPolicy bool,
@@ -224,7 +250,6 @@ func BuildManager(
 		integratedPeerValidator:  integratedPeerValidator,
 		metrics:                  metrics,
 		requestBuffer:            NewAccountRequestBuffer(ctx, store),
-		proxyController:          proxyController,
 		settingsManager:          settingsManager,
 		permissionsManager:       permissionsManager,
 		disableDefaultPolicy:     disableDefaultPolicy,
@@ -305,6 +330,9 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	var groupChangesAffectPeers bool
 	var reloadReverseProxy bool
 	var effectiveOldNetworkRange netip.Prefix
+	var ipv6Changed bool
+	var ipv6Snap *affectedpeers.Snapshot
+	var ipv6Change affectedpeers.Change
 
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		var groupsUpdated bool
@@ -350,10 +378,10 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 
 		if ipv6SettingsChanged(oldSettings, newSettings) {
-			if err = am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings); err != nil {
+			if ipv6Change, err = am.applyIPv6SettingsChange(ctx, transaction, accountID, oldSettings, newSettings); err != nil {
 				return err
 			}
-			updateAccountPeers = true
+			ipv6Changed = true
 		}
 
 		if oldSettings.RoutingPeerDNSResolutionEnabled != newSettings.RoutingPeerDNSResolutionEnabled ||
@@ -391,12 +419,20 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 			return err
 		}
 
-		if updateAccountPeers || groupsUpdated {
+		if updateAccountPeers || groupsUpdated || ipv6Changed {
 			if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 				return err
 			}
 		}
 
+		// A full account refresh already covers the IPv6 change, so the affected-peers
+		// snapshot is only needed when nothing account-wide changed.
+		if ipv6Changed && !updateAccountPeers && !groupChangesAffectPeers {
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return fmt.Errorf("load affected peers: %w", err)
+			}
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -459,13 +495,34 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 	}
 
-	if updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers {
+	switch {
+	case updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers:
 		go am.UpdateAccountPeers(context.WithoutCancel(ctx), accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
+	case ipv6Snap != nil:
+		am.ExpandAndUpdateAffected(ctx, accountID, ipv6Snap, ipv6Change)
 	}
 
 	return newSettings, nil
 }
 
+// applyIPv6SettingsChange reconciles peer IPv6 addresses for new IPv6 settings and
+// returns the affected-peers change: peers whose address changed refresh together
+// with every peer that reaches them. On a range change every peer holding an address
+// also refreshes itself, since its interface prefix comes from the account range even
+// when its address stays inside the new one.
+func (am *DefaultAccountManager) applyIPv6SettingsChange(ctx context.Context, transaction store.Store, accountID string, oldSettings, newSettings *types.Settings) (affectedpeers.Change, error) {
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings)
+	if err != nil {
+		return affectedpeers.Change{}, err
+	}
+
+	change := affectedpeers.Change{ChangedPeerIDs: result.changed}
+	if oldSettings.NetworkRangeV6 != newSettings.NetworkRangeV6 {
+		change.OutputPeerIDs = result.withIPv6
+	}
+	return change, nil
+}
+
 func ipv6SettingsChanged(old, updated *types.Settings) bool {
 	if old.NetworkRangeV6 != updated.NetworkRangeV6 {
 		return true
@@ -902,6 +959,10 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
 		return status.Errorf(status.Internal, "failed to build user infos for account %s: %v", accountID, err)
 	}
 
+	if err = am.runAccountDeletionHooks(ctx, accountID); err != nil {
+		return err
+	}
+
 	if err = am.deleteAccountUsers(ctx, accountID, userID, account.Users, userInfosMap); err != nil {
 		return err
 	}
@@ -1722,9 +1783,11 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 
 			change.LinkGroups = allGroupChanges
 
-			if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges); err != nil {
+			ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges)
+			if err != nil {
 				return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 			}
+			change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
 
 			if err = transaction.IncrementNetworkSerial(ctx, userAuth.AccountId); err != nil {
 				return fmt.Errorf("error incrementing network serial: %w", err)
@@ -2314,7 +2377,8 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, err
 	}
 
-	if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups); err != nil {
+	ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups)
+	if err != nil {
 		return false, false, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 	}
 
@@ -2323,7 +2387,7 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, fmt.Errorf("error checking if group changes affect peers: %w", err)
 	}
 
-	return len(updatedGroups) > 0, peersAffected, nil
+	return len(updatedGroups) > 0, peersAffected || len(ipv6Changed) > 0, nil
 }
 
 // propagateAutoGroupsForUsers adds each user's peers to their AutoGroups where not already present.
@@ -2371,7 +2435,7 @@ func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, t
 		return err
 	}
 
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
 		return err
 	}
@@ -2408,7 +2472,7 @@ func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, t
 // v6 address get one allocated. When disabled, all v6 addresses are cleared.
 // When the v6 range changes, all v6 addresses are reallocated.
 func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transaction store.Store, accountID, peerID string, newIPv6 netip.Addr) error {
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
 	if err != nil {
 		return fmt.Errorf("get peers: %w", err)
 	}
@@ -2420,56 +2484,78 @@ func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transac
 	return nil
 }
 
-func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) error {
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "")
+// ipv6Reassignment reports the outcome of an IPv6 address reconciliation.
+type ipv6Reassignment struct {
+	// changed are the peers whose IPv6 address was assigned, removed or reallocated.
+	changed []string
+	// withIPv6 are all peers holding an IPv6 address after the reconciliation.
+	withIPv6 []string
+}
+
+func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) (ipv6Reassignment, error) {
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
-		return fmt.Errorf("get peers: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get peers: %w", err)
 	}
 
 	network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthUpdate, accountID)
 	if err != nil {
-		return fmt.Errorf("get network: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get network: %w", err)
 	}
 
 	if err := am.ensureIPv6Subnet(ctx, transaction, accountID, settings, network); err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	allowedPeers, err := am.buildIPv6AllowedPeers(ctx, transaction, accountID, settings)
 	if err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	v6Prefix, err := netip.ParsePrefix(network.NetV6.String())
 	if err != nil {
-		return fmt.Errorf("parse IPv6 prefix: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("parse IPv6 prefix: %w", err)
 	}
 
-	if err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix); err != nil {
-		return err
+	changed, err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix)
+	if err != nil {
+		return ipv6Reassignment{}, err
 	}
 
-	log.WithContext(ctx).Infof("updated IPv6 addresses for %d peers in account %s (groups=%d)",
-		len(peers), accountID, len(settings.IPv6EnabledGroups))
+	result := ipv6Reassignment{changed: changed}
+	for _, peer := range peers {
+		if peer.IPv6.IsValid() {
+			result.withIPv6 = append(result.withIPv6, peer.ID)
+		}
+	}
 
-	return nil
+	log.WithContext(ctx).Infof("updated IPv6 addresses for %d of %d peers in account %s (groups=%d)",
+		len(changed), len(peers), accountID, len(settings.IPv6EnabledGroups))
+
+	return result, nil
 }
 
 // reconcileIPv6ForGroupChanges checks whether the given group IDs overlap with
 // the account's IPv6EnabledGroups. If they do, it runs a full IPv6 address
 // reconciliation so that peers gaining or losing membership in an IPv6-enabled
-// group get their addresses assigned or removed.
-func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) error {
+// group get their addresses assigned or removed. It returns the peers whose IPv6
+// address changed, which callers pass as changed peers so every peer that can
+// reach them refreshes.
+func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) ([]string, error) {
 	settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
-		return fmt.Errorf("get account settings: %w", err)
+		return nil, fmt.Errorf("get account settings: %w", err)
 	}
 
 	if !ipv6ReconcileNeeded(settings, groupIDs) {
-		return nil
+		return nil, nil
 	}
 
-	return am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	if err != nil {
+		return nil, err
+	}
+	return result.changed, nil
 }
 
 // ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
@@ -2508,7 +2594,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 	ctx context.Context, transaction store.Store, accountID string,
 	peers []*nbpeer.Peer, network *types.Network,
 	allowedPeers map[string]struct{}, v6Prefix netip.Prefix,
-) error {
+) ([]string, error) {
 	takenV6 := make(map[netip.Addr]struct{})
 	for _, peer := range peers {
 		if _, ok := allowedPeers[peer.ID]; ok && peer.IPv6.IsValid() && network.NetV6.Contains(peer.IPv6.AsSlice()) {
@@ -2516,6 +2602,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 	}
 
+	var changed []string
 	for _, peer := range peers {
 		_, allowed := allowedPeers[peer.ID]
 		oldIPv6 := peer.IPv6
@@ -2525,7 +2612,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		} else if !peer.IPv6.IsValid() || !network.NetV6.Contains(peer.IPv6.AsSlice()) {
 			newIP, err := allocateIPv6WithRetry(v6Prefix, takenV6, peer.ID)
 			if err != nil {
-				return err
+				return nil, err
 			}
 			peer.IPv6 = newIP
 		}
@@ -2535,10 +2622,11 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 
 		if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
-			return fmt.Errorf("save peer %s: %w", peer.ID, err)
+			return nil, fmt.Errorf("save peer %s: %w", peer.ID, err)
 		}
+		changed = append(changed, peer.ID)
 	}
-	return nil
+	return changed, nil
 }
 
 func allocateIPv6WithRetry(prefix netip.Prefix, taken map[netip.Addr]struct{}, peerID string) (netip.Addr, error) {
@@ -2582,7 +2670,7 @@ func (am *DefaultAccountManager) buildIPv6AllowedPeers(ctx context.Context, tran
 
 	// Embedded proxy peers sit outside regular group membership but must
 	// participate in any v6-enabled overlay to reach v6-only peers.
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	if err != nil {
 		return nil, fmt.Errorf("get peers: %w", err)
 	}
@@ -2653,7 +2741,7 @@ func (am *DefaultAccountManager) updatePeerIPInTransaction(ctx context.Context,
 			return nil
 		}
 
-		peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "")
+		peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
 		if err != nil {
 			return fmt.Errorf("get account peers: %w", err)
 		}

management/server/account/deletion_hook.go

@@ -0,0 +1,14 @@
+package account
+
+import "context"
+
+// DeletionHook runs when an account is deleted, after the caller's permission to delete
+// it has been checked and before any of its users or data are removed. It lets code that
+// keeps per-account state outside the store tear that state down while the account still
+// exists.
+//
+// A hook that returns an error aborts the deletion and the account is kept. The caller
+// sees the error, so a hook that wants a specific response returns a status error. A
+// retried deletion runs every hook again, and a later step can still fail after the hooks
+// succeed, so a hook must be idempotent and must tolerate the account surviving it.
+type DeletionHook func(ctx context.Context, accountID string) error

management/server/account/manager.go

@@ -62,7 +62,7 @@ type Manager interface {
 	GetUserByID(ctx context.Context, id string) (*types.User, error)
 	GetUserFromUserAuth(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 	ListUsers(ctx context.Context, accountID string) ([]*types.User, error)
-	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
 	MarkPeerConnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error
 	MarkPeerDisconnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error
 	DeletePeer(ctx context.Context, accountID, peerID, userID string) error

management/server/account/manager_mock.go

@@ -982,18 +982,18 @@ func (mr *MockManagerMockRecorder) GetPeerNetwork(ctx, peerID any) *gomock.Call
 }
 
 // GetPeers mocks base method.
-func (m *MockManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*peer.Peer, error) {
+func (m *MockManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*peer.Peer, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetPeers", ctx, accountID, userID, nameFilter, ipFilter)
+	ret := m.ctrl.Call(m, "GetPeers", ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 	ret0, _ := ret[0].([]*peer.Peer)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPeers indicates an expected call of GetPeers.
-func (mr *MockManagerMockRecorder) GetPeers(ctx, accountID, userID, nameFilter, ipFilter any) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeers(ctx, accountID, userID, nameFilter, ipFilter, macFilter any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeers", reflect.TypeOf((*MockManager)(nil).GetPeers), ctx, accountID, userID, nameFilter, ipFilter)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeers", reflect.TypeOf((*MockManager)(nil).GetPeers), ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 }
 
 // GetPolicy mocks base method.

management/server/account_test.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus/push"
@@ -40,6 +41,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbAccount "github.com/netbirdio/netbird/management/server/account"
@@ -47,7 +49,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -958,6 +959,101 @@ func TestAccountManager_DeleteAccount(t *testing.T) {
 	assert.Len(t, pats, 0)
 }
 
+func TestAccountManager_DeleteAccount_RunsDeletionHooks(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	// Each hook records its call and checks the account is still in the store, which is
+	// the point of running before deletion: a hook must be able to read what it cleans up.
+	var calls []string
+	hook := func(name string) nbAccount.DeletionHook {
+		return func(ctx context.Context, accountID string) error {
+			calls = append(calls, name+":"+accountID)
+			_, err := manager.Store.GetAccount(ctx, accountID)
+			assert.NoError(t, err, "account should still exist while hook %s runs", name)
+			return nil
+		}
+	}
+	manager.AddAccountDeletionHook(hook("first"))
+	manager.AddAccountDeletionHook(hook("second"))
+
+	require.NoError(t, manager.DeleteAccount(context.Background(), account.Id, ownerID))
+
+	assert.Equal(t, []string{"first:" + account.Id, "second:" + account.Id}, calls,
+		"hooks should run once each, in registration order, with the deleted account's ID")
+	_, err = manager.Store.GetAccount(context.Background(), account.Id)
+	assert.Error(t, err, "account should be deleted after the hooks succeed")
+}
+
+func TestAccountManager_DeleteAccount_DeletionHookErrorAbortsDeletion(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		return status.Errorf(status.PreconditionFailed, "teardown refused")
+	})
+	secondCalled := false
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		secondCalled = true
+		return nil
+	})
+
+	err = manager.DeleteAccount(context.Background(), account.Id, ownerID)
+	require.Error(t, err)
+
+	// The hook's status type has to survive the wrapping, since the HTTP layer maps it
+	// to the response code.
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should carry the hook's status error, got %v", err)
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "status type should be the hook's")
+	assert.False(t, secondCalled, "hooks after a failing one should not run")
+
+	_, err = manager.Store.GetAccount(context.Background(), account.Id)
+	assert.NoError(t, err, "account should survive a failing hook")
+	_, err = manager.Store.GetUserByUserID(context.Background(), store.LockingStrengthNone, ownerID)
+	assert.NoError(t, err, "account owner should survive a failing hook")
+}
+
+func TestAccountManager_AddAccountDeletionHook_RejectsNil(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	assert.PanicsWithValue(t, "nil account deletion hook", func() {
+		manager.AddAccountDeletionHook(nil)
+	}, "registering a nil hook should panic instead of breaking a later deletion")
+}
+
+func TestAccountManager_DeleteAccount_DeletionHooksSkippedWithoutPermission(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	adminID := "regular_admin"
+	account.Users[adminID] = types.NewAdminUser(adminID)
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	called := false
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		called = true
+		return nil
+	})
+
+	err = manager.DeleteAccount(context.Background(), account.Id, adminID)
+	require.Error(t, err, "only the owner may delete the account")
+	assert.False(t, called, "hooks should not run for a caller who may not delete the account")
+}
+
 func BenchmarkTest_GetAccountWithclaims(b *testing.B) {
 	claims := auth.UserAuth{
 		Domain:         "example.com",
@@ -1202,7 +1298,9 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_SaveGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SaveGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
@@ -1235,6 +1333,8 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1257,7 +1357,9 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
@@ -1266,13 +1368,7 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
-	// Ensure that we do not receive an update message before the policy is deleted
-	time.Sleep(time.Second)
-	select {
-	case <-updMsg:
-		t.Logf("received addPeer update message before policy deletion")
-	default:
-	}
+	settleAffectedUpdates(updMsg)
 
 	wg := sync.WaitGroup{}
 	wg.Add(1)
@@ -1295,7 +1391,9 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_SavePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SavePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
@@ -1315,6 +1413,8 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1348,7 +1448,9 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePeer(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePeer(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
@@ -1387,6 +1489,8 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1408,7 +1512,9 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeleteGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeleteGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
@@ -1455,6 +1561,8 @@ func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
 		}
 	}
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -2462,7 +2570,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_PeerApproval(t *testing.T)
 	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, newSettings)
 	require.NoError(t, err)
 
-	accountPeers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	accountPeers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 
 	for _, peer := range accountPeers {
@@ -3487,6 +3595,9 @@ func createManagerWithNetworkMapStore(t testing.TB) (*DefaultAccountManager, *up
 
 	nmdataStore, err := networkmapdbfactory.NewNetworkMapDBStore(context.Background(), types.SqliteStoreEngine, dataDir, MockIntegratedValidator{}, newSettingsMockManager(t))
 	require.NoError(t, err)
+	sqliteStore, ok := nmdataStore.Store.(*networkmap_sqlite.SqliteStore)
+	require.True(t, ok, "network map store is %T, want *networkmap_sqlite.SqliteStore", nmdataStore.Store)
+	t.Cleanup(func() { assert.NoError(t, sqliteStore.Db.Close()) })
 
 	manager, updateManager, err := buildTestManager(t, store, nmdataStore)
 	require.NoError(t, err)
@@ -3541,20 +3652,24 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 		Return(nil).
 		AnyTimes()
 
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// The go-cache janitor only stops via a GC finalizer and would outlive synctest bubbles.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
-	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
+	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := manager.cacheManager
+	t.Cleanup(func() { assert.NoError(t, cacheManager.Close()) })
 
 	proxyGrpcServer := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, peersManager, nil, nil, proxyManager, nil)
+	t.Cleanup(proxyGrpcServer.Close)
 	proxyController, err := proxymanager.NewGRPCController(proxyGrpcServer, noop.Meter{})
 	if err != nil {
 		return nil, nil, err
@@ -3648,6 +3763,33 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *update_channel.
 // when the channel delivers.
 const peerUpdateTimeout = 5 * time.Second
 
+// peerUpdateSettleTime bounds how far settleAffectedUpdates advances the fake clock. It must exceed
+// the account request and peer update buffer intervals.
+const peerUpdateSettleTime = time.Second
+
+// runPeerUpdateTest runs f inside synctest.Test, so the peer update helpers observe every background
+// goroutine of the test, and lets the updates still in flight when f returns finish before the bubble
+// ends, since the bubble's clock stops with it.
+func runPeerUpdateTest(t *testing.T, f func(t *testing.T)) {
+	synctest.Test(t, func(t *testing.T) {
+		defer settleAffectedUpdates()
+		f(t)
+	})
+}
+
+// settleAffectedUpdates runs the synctest bubble's fake clock past every update buffer interval until
+// all goroutines are blocked, then discards the updates already delivered to chans, so the next
+// assertion only observes updates from the action under test. It must be called inside synctest.Test.
+func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
+	time.Sleep(peerUpdateSettleTime)
+	synctest.Wait()
+	for _, ch := range chans {
+		for len(ch) > 0 {
+			<-ch
+		}
+	}
+}
+
 func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	for {
 		select {
@@ -3661,6 +3803,19 @@ func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	}
 }
 
+// step runs f as one named stage of a test inside synctest.Test, which forbids t.Run, and names the
+// stage when it fails the test. Stages share t, so a fatal failure ends the remaining stages as well.
+func step(t *testing.T, name string, f func(t *testing.T)) {
+	t.Helper()
+	failedBefore := t.Failed()
+	defer func() {
+		if !failedBefore && t.Failed() {
+			t.Logf("step %q failed", name)
+		}
+	}()
+	f(t)
+}
+
 func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *network_map.UpdateMessage) {
 	t.Helper()
 	select {
@@ -4462,7 +4617,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	require.Len(t, peers, len(before))
 	for _, p := range peers {
@@ -4480,7 +4635,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.Equal(t, before[p.ID], p.IP, "peer %s IP should not change for host-bit-set equivalent range", p.ID)
@@ -4494,7 +4649,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.Equal(t, before[p.ID], p.IP, "peer %s IP should not change when NetworkRange omitted", p.ID)
@@ -4510,7 +4665,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.True(t, newRange.Contains(p.IP), "peer %s should be in new range %s, got %s", p.ID, newRange, p.IP)
@@ -4528,7 +4683,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	require.NoError(t, err)
 	require.NotEmpty(t, settings.IPv6EnabledGroups, "new account should have IPv6 enabled for All group")
 
-	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.True(t, p.IPv6.IsValid(), "peer %s should have IPv6 with All group enabled", p.ID)
@@ -4556,7 +4711,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	assert.Equal(t, []string{partialGroup.ID}, updatedSettings.IPv6EnabledGroups)
 
 	// peer1 and peer2 should have IPv6; peer3 should not.
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	peerMap := make(map[string]*nbpeer.Peer, len(peers))
 	for _, p := range peers {
@@ -4576,7 +4731,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	require.NoError(t, err)
 	assert.Empty(t, updatedSettings.IPv6EnabledGroups)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.False(t, p.IPv6.IsValid(), "peer %s should have no IPv6 when groups cleared", p.ID)
@@ -4591,7 +4746,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	peerMap = make(map[string]*nbpeer.Peer, len(peers))
 	for _, p := range peers {

management/server/affected_peers_ipv6_test.go

@@ -0,0 +1,243 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const (
+	ipv6GroupA = "ipv6-grp-a"
+	ipv6GroupB = "ipv6-grp-b"
+	ipv6GroupC = "ipv6-grp-c"
+	ipv6GroupD = "ipv6-grp-d"
+)
+
+// ipv6AffectedTest holds three peers: peer1 in group A, peer2 in group B, peer3 in
+// group C, with a single A<->B policy. peer3 is unrelated to peer1 and peer2. Group D
+// is empty and referenced by nothing.
+type ipv6AffectedTest struct {
+	manager                   *DefaultAccountManager
+	accountID                 string
+	peer1, peer2, peer3       *nbpeer.Peer
+	updMsg1, updMsg2, updMsg3 <-chan *network_map.UpdateMessage
+}
+
+func setupIPv6AffectedTest(t *testing.T, ipv6Groups []string) *ipv6AffectedTest {
+	t.Helper()
+
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	for _, g := range []*types.Group{
+		{ID: ipv6GroupA, Name: "IPv6-A", Peers: []string{peer1.ID}},
+		{ID: ipv6GroupB, Name: "IPv6-B", Peers: []string{peer2.ID}},
+		{ID: ipv6GroupC, Name: "IPv6-C", Peers: []string{peer3.ID}},
+		{ID: ipv6GroupD, Name: "IPv6-D"},
+	} {
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, g))
+	}
+
+	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{{
+			Enabled:       true,
+			Sources:       []string{ipv6GroupA},
+			Destinations:  []string{ipv6GroupB},
+			Bidirectional: true,
+			Action:        types.PolicyTrafficActionAccept,
+		}},
+	}, true)
+	require.NoError(t, err)
+
+	// New accounts enable IPv6 for the All group; start from the requested groups.
+	updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = ipv6Groups
+	})
+
+	tc := &ipv6AffectedTest{
+		manager:   manager,
+		accountID: accountID,
+		peer1:     peer1,
+		peer2:     peer2,
+		peer3:     peer3,
+	}
+	tc.updMsg1 = updateManager.CreateChannel(ctx, peer1.ID)
+	tc.updMsg2 = updateManager.CreateChannel(ctx, peer2.ID)
+	tc.updMsg3 = updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	// The setup changes above dispatch asynchronously and can land after the
+	// channels open, so drop them before the test acts.
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	return tc
+}
+
+// updateIPv6TestSettings applies mutate to a copy of the current settings, so only
+// the mutated fields differ from what is stored.
+func updateIPv6TestSettings(t *testing.T, manager *DefaultAccountManager, accountID string, mutate func(*types.Settings)) {
+	t.Helper()
+	ctx := context.Background()
+
+	current, err := manager.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+
+	updated := current.Copy()
+	mutate(updated)
+
+	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, updated)
+	require.NoError(t, err)
+}
+
+func (tc *ipv6AffectedTest) peerIPv6(t *testing.T, peerID string) netip.Addr {
+	t.Helper()
+	peer, err := tc.manager.Store.GetPeerByID(context.Background(), store.LockingStrengthNone, tc.accountID, peerID)
+	require.NoError(t, err)
+	return peer.IPv6
+}
+
+func TestAffectedPeers_IPv6GroupEnabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+	})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6GroupDisabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should start with an IPv6 address")
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{}
+	})
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Widening the IPv6 range keeps peer addresses, but each holder's interface prefix
+// comes from the range, so holders refresh while peers that only reach them do not.
+func TestAffectedPeers_IPv6RangeWidened_RefreshesAddressHolders(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	oldIPv6 := tc.peerIPv6(t, tc.peer1.ID)
+	require.True(t, oldIPv6.IsValid(), "peer1 should start with an IPv6 address")
+
+	// The range is allocated on the account network; settings may leave it empty.
+	network, err := tc.manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, tc.accountID)
+	require.NoError(t, err)
+	current := prefixFromIPNet(network.NetV6)
+	require.True(t, current.IsValid(), "account should have an IPv6 range")
+	widened := netip.PrefixFrom(current.Addr(), current.Bits()-8).Masked()
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRangeV6 = widened
+	})
+	require.Equal(t, oldIPv6, tc.peerIPv6(t, tc.peer1.ID), "peer1 should keep its address inside the widened range")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldNotReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv4RangeChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRange = netip.MustParsePrefix("100.70.0.0/16")
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6WithAccountWideChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+		s.LazyConnectionEnabled = !s.LazyConnectionEnabled
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+// Joining an IPv6-enabled group that no policy references gives peer1 an address.
+// peer2 reaches peer1 through group A, not through the joined group, and must still
+// learn the new address.
+func TestAffectedPeers_GroupAddPeerIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.GroupAddPeer(context.Background(), tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_UpdateGroupIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.UpdateGroup(context.Background(), tc.accountID, userID, &types.Group{
+		ID:    ipv6GroupD,
+		Name:  "IPv6-D",
+		Peers: []string{tc.peer1.ID},
+	}))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Deleting an IPv6-enabled group removes its members' addresses after the
+// pre-delete snapshot was taken.
+func TestAffectedPeers_DeleteIPv6Group_RefreshesFormerMembersAndReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+	ctx := context.Background()
+
+	require.NoError(t, tc.manager.GroupAddPeer(ctx, tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	require.NoError(t, tc.manager.DeleteGroup(ctx, tc.accountID, userID, ipv6GroupD))
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}

management/server/affected_peers_jwt_test.go

@@ -87,93 +87,93 @@ func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T)
 // auto-group change updates only the user's peers and the peers linked to the changed
 // group through policies, instead of fanning out to the whole account.
 func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
-	}, false)
-	require.NoError(t, err)
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
+		}, false)
+		require.NoError(t, err)
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.JWTGroupsEnabled = true
-	account.Settings.JWTGroupsClaimName = "groups"
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.JWTGroupsEnabled = true
+		account.Settings.JWTGroupsClaimName = "groups"
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
 
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"jwt-grp"},
-				Destinations:  []string{"jwt-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"jwt-grp"},
+					Destinations:  []string{"jwt-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updUser := updateManager.CreateChannel(ctx, userPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, userPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	userAuth := auth.UserAuth{
-		AccountId: accountID,
-		UserId:    userID,
-		Groups:    []string{"jwt-linked"},
-	}
-
-	t.Run("adding JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+		}, true)
 		require.NoError(t, err)
-		assert.Contains(t, user.AutoGroups, "jwt-grp")
-	})
 
-	t.Run("removing JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+		updUser := updateManager.CreateChannel(ctx, userPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, userPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
 
-		userAuth.Groups = nil
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+		userAuth := auth.UserAuth{
+			AccountId: accountID,
+			UserId:    userID,
+			Groups:    []string{"jwt-linked"},
+		}
 
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "adding JWT group updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updUser, upd2, upd3)
 
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.NotContains(t, user.AutoGroups, "jwt-grp")
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.Contains(t, user.AutoGroups, "jwt-grp")
+		})
+
+		step(t, "removing JWT group updates only linked peers", func(t *testing.T) {
+			drainPeerUpdates(updUser)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			userAuth.Groups = nil
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.NotContains(t, user.AutoGroups, "jwt-grp")
+		})
 	})
 }

management/server/affected_peers_oldstate_test.go

@@ -24,120 +24,124 @@ import (
 // detaching one of them must still refresh that group's policy source peers, even
 // though the post-update resource no longer maps to it.
 func TestAffectedPeers_E2E_UpdateResource_DetachGroup_RefreshesOldGroupSources(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A second resource group + a second source group/peer that reaches the
-	// resource only through that second group.
-	const detachGroupID = "rs-detach-grp"
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
+		// A second resource group + a second source group/peer that reaches the
+		// resource only through that second group.
+		const detachGroupID = "rs-detach-grp"
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID, detachGroupID},
-		Enabled:   true,
+		// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID, detachGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		// Policy granting the second source group access via the detach group.
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
+		require.NoError(t, err)
+
+		secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
+		settleAffectedUpdates(secondSrcCh)
+
+		done := make(chan struct{})
+		go func() {
+			// Detaching the resource from detachGroup removes the second source's
+			// access; that source peer must be refreshed even though the post-update
+			// resource no longer maps to detachGroup.
+			peerShouldReceiveUpdate(t, secondSrcCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
+		}
 	})
-	require.NoError(t, err)
-
-	// Policy granting the second source group access via the detach group.
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
-	require.NoError(t, err)
-
-	secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
-	settleAffectedUpdates(secondSrcCh)
-
-	done := make(chan struct{})
-	go func() {
-		// Detaching the resource from detachGroup removes the second source's
-		// access; that source peer must be refreshed even though the post-update
-		// resource no longer maps to detachGroup.
-		peerShouldReceiveUpdate(t, secondSrcCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
-	}
 }
 
 // TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer:
 // changing router.Peer within the same network must still refresh the OLD routing
 // peer, which loses its routing role.
 func TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	_, routersManager, _ := s.managers()
+		_, routersManager, _ := s.managers()
 
-	routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
-	require.NoError(t, err)
-	require.Len(t, routers, 1)
-	router := routers[0]
-	oldRoutingPeer := router.Peer
-	require.NotEmpty(t, oldRoutingPeer)
+		routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
+		require.NoError(t, err)
+		require.Len(t, routers, 1)
+		router := routers[0]
+		oldRoutingPeer := router.Peer
+		require.NotEmpty(t, oldRoutingPeer)
 
-	// A new peer to become the routing peer in place of the old one.
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		// A new peer to become the routing peer in place of the old one.
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
 
-	oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
-	settleAffectedUpdates(oldCh)
+		oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
+		settleAffectedUpdates(oldCh)
 
-	done := make(chan struct{})
-	go func() {
-		// The old routing peer stops serving the resource and must be refreshed.
-		peerShouldReceiveUpdate(t, oldCh)
-		close(done)
-	}()
+		done := make(chan struct{})
+		go func() {
+			// The old routing peer stops serving the resource and must be refreshed.
+			peerShouldReceiveUpdate(t, oldCh)
+			close(done)
+		}()
 
-	_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		ID:         router.ID,
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       newRoutingPeer.ID, // repoint within the same network
-		Masquerade: true,
-		Metric:     9999,
-		Enabled:    true,
+		_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			ID:         router.ID,
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       newRoutingPeer.ID, // repoint within the same network
+			Masquerade: true,
+			Metric:     9999,
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
+		}
 	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
-	}
 }

management/server/affected_peers_router_paths_test.go

@@ -165,148 +165,154 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context
 }
 
 func TestAffectedPeers_E2E_SavePostureCheck_RefreshesRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
+		checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
+			ID:   checkID,
+			Name: "rs-min-version",
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
+			},
+		}, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: editing a posture check did not refresh source + routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
-		ID:   checkID,
-		Name: "rs-min-version",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
-		},
-	}, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: editing a posture check did not refresh source + routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdateResource_DestinationResourcePolicy_RefreshesSourcePeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
-	}
 }
 
 // A disabled sibling router routes to nobody, so updating a resource on its network
 // must NOT refresh its peer (the enabled router carries the bridge instead).
 func TestAffectedPeers_E2E_UpdateResource_DisabledSiblingRouterNotBridged(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	resourcesManager, routersManager, _ := s.managers()
+		resourcesManager, routersManager, _ := s.managers()
 
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       disabledRouterPeer.ID,
-		Masquerade: true,
-		Metric:     9000,
-		Enabled:    false,
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       disabledRouterPeer.ID,
+			Masquerade: true,
+			Metric:     9000,
+			Enabled:    false,
+		})
+		require.NoError(t, err)
+
+		disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
+		enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(disabledCh, enabledCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, enabledCh)
+			peerShouldNotReceiveUpdate(t, disabledCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout")
+		}
 	})
-	require.NoError(t, err)
-
-	disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
-	enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-	})
-
-	settleAffectedUpdates(disabledCh, enabledCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, enabledCh)
-		peerShouldNotReceiveUpdate(t, disabledCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout")
-	}
 }
 
 func TestAffectedPeers_GroupChange_RouterInOtherNetworkNotAffected(t *testing.T) {
@@ -346,8 +352,10 @@ func TestAffectedPeers_PeerChange_RouterInOtherNetworkNotAffected(t *testing.T)
 // shortcut (the denied peer's map holds no router) and the allow direction
 // depends on which meta field moved, leaving the routers with a stale map.
 func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+		})
 	})
 }
 
@@ -355,8 +363,10 @@ func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
 // scenario with the source peer named directly in the rule: it must receive its posture
 // checks and have its flips detected exactly like a group member.
 func TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+		})
 	})
 }
 

management/server/affected_peers_router_test.go

@@ -8,7 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/groups"
@@ -320,190 +319,189 @@ func TestAffectedPeers_PolicyToResource_UnrelatedPeerNotAffected(t *testing.T) {
 }
 
 func TestAffectedPeers_ResourceSideBridgesToRoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A pre-existing policy grants the source group access to the resource.
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		// A pre-existing policy grants the source group access to the resource.
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	// Drive an update through the resource manager and assert the routing peer
-	// is among the affected set by observing the channel. This path walks
-	// policies whose destinations reference the resource's groups, folds in the
-	// source groups, and loads the network's routers, so it reaches both the
-	// source peer and the routing peer.
-	permissionsManager := permissions.NewManager(s.manager.Store)
-	groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
-	rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
+		// Drive an update through the resource manager and assert the routing peer
+		// is among the affected set by observing the channel. This path walks
+		// policies whose destinations reference the resource's groups, folds in the
+		// source groups, and loads the network's routers, so it reaches both the
+		// source peer and the routing peer.
+		permissionsManager := permissions.NewManager(s.manager.Store)
+		groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
+		rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: resource update did not refresh source peer + routing peer")
+		}
 	})
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: resource update did not refresh source peer + routing peer")
-	}
-}
-
-// settleAffectedUpdates waits for in-flight async updates to arrive, then drains
-// every given channel so subsequent assertions start from a clean slate.
-//
-// Setup (CreateNetwork/CreateResource/CreateRouter) fires async UpdateAffectedPeers
-// goroutines; draining first means the assertion only observes updates from the
-// action under test, not setup stragglers.
-func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
-	time.Sleep(300 * time.Millisecond)
-	for _, ch := range chans {
-		drainPeerUpdates(ch)
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
-	}
 }
 
 func TestAffectedPeers_E2E_DeletePolicy_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func (s *routerScenario) managers() (resources.Manager, routers.Manager, networks.Manager) {
@@ -572,113 +570,119 @@ func (s *routerScenario) addSecondTopology(t *testing.T, suffix string) secondTo
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_BothRoutingPeers(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	second := s.addSecondTopology(t, "b")
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		second := s.addSecondTopology(t, "b")
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerACh, routerBCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerACh)
+			peerShouldReceiveUpdate(t, routerBCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Destinations = []string{second.resourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerACh, routerBCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerACh)
-		peerShouldReceiveUpdate(t, routerBCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Destinations = []string{second.resourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_AddSource(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(newSrcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, newSrcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
+		}
 	})
-
-	settleAffectedUpdates(newSrcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, newSrcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_AllRoutingPeers_Network(t *testing.T) {

management/server/affected_peers_user_test.go

@@ -17,154 +17,152 @@ import (
 // A user update refreshes only the peers its auto-group change reaches, and a user
 // update that changes no group membership refreshes nobody.
 func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	const targetUserID = "target-user"
-	require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
-		Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-	}))
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
-	}, false)
-	require.NoError(t, err)
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
-
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
-
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ug-linked"},
-				Destinations:  []string{"ug-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, targetPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("auto group change updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+		const targetUserID = "target-user"
+		require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
 			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"},
-		})
+		}))
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
+		}, false)
 		require.NoError(t, err)
 
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("update without group changes refreshes nobody", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"}, Name: "renamed",
-		})
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-		peerShouldNotReceiveUpdate(t, updTarget)
-		peerShouldNotReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+		account, err = manager.Store.GetAccount(ctx, accountID)
 		require.NoError(t, err)
-		assert.Equal(t, "renamed", user.Name)
-	})
-
-	t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
-		account, err := manager.Store.GetAccount(ctx, accountID)
-		require.NoError(t, err)
-		account.Settings.IPv6EnabledGroups = []string{"ug-v6"}
+		account.Settings.GroupsPropagationEnabled = true
 		require.NoError(t, manager.Store.SaveAccount(ctx, account))
-		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
 
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
 
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		// The reassigned peer refreshes with everyone it can reach: peer2 via the
-		// policy, but not peer3, which shares no group or policy with it.
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
-		// An SSH rule that authorizes no group of its own ships the account's
-		// allowed-user set to its destinations, so those are the peers an unblock
-		// reaches — not the whole account.
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
 			Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled:      true,
-				Sources:      []string{"ug-linked"},
-				Destinations: []string{"ug-dest"},
-				Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-				Action:       types.PolicyTrafficActionAccept,
-			}},
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ug-linked"},
+					Destinations:  []string{"ug-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
 		}, true)
 		require.NoError(t, err)
 
-		blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		blocked.Blocked = true
-		require.NoError(t, manager.Store.SaveUser(ctx, blocked))
-
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		// Same auto-groups as the previous subtest left them, so no group change and
-		// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+		updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, targetPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
 		})
-		require.NoError(t, err)
 
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "auto group change updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"},
+			})
+			require.NoError(t, err)
+
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+
+		step(t, "update without group changes refreshes nobody", func(t *testing.T) {
+			drainPeerUpdates(updTarget)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			peerShouldNotReceiveUpdate(t, updTarget)
+			peerShouldNotReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			assert.Equal(t, "renamed", user.Name)
+		})
+
+		step(t, "auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
+
+			require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))// Apply through the settings API so the reconciliation that strips the other
+		// peers' addresses happens here, leaving the target as the only peer the
+		// user update reassigns.
+		updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+			s.IPv6EnabledGroups = []string{"ug-v6"}
+		})
+
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			// The reassigned peer refreshes with everyone it can reach: peer2 via the
+			// policy, but not peer3, which shares no group or policy with it.
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+
+		step(t, "unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
+			// An SSH rule that authorizes no group of its own ships the account's
+			// allowed-user set to its destinations, so those are the peers an unblock
+			// reaches — not the whole account.
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{{
+					Enabled:      true,
+					Sources:      []string{"ug-linked"},
+					Destinations: []string{"ug-dest"},
+					Protocol:     types.PolicyRuleProtocolNetbirdSSH,
+					Action:       types.PolicyTrafficActionAccept,
+				}},
+			}, true)
+			require.NoError(t, err)
+
+			blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			blocked.Blocked = true
+			require.NoError(t, manager.Store.SaveUser(ctx, blocked))
+
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			// Same auto-groups as the previous subtest left them, so no group change and
+			// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
 	})
 }

management/server/affected_peers_zone_test.go

@@ -0,0 +1,145 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const affectedZoneDomain = "zone.test"
+
+// createAffectedZone stores a zone distributed to the given groups, optionally with
+// one A record so the network map actually ships it.
+func createAffectedZone(t *testing.T, s store.Store, accountID, domain string, enabled, withRecord bool, groups []string) *zones.Zone {
+	t.Helper()
+	ctx := context.Background()
+
+	zone := zones.NewZone(accountID, domain, domain, enabled, false, groups)
+	require.NoError(t, s.CreateZone(ctx, zone))
+
+	if withRecord {
+		record := records.NewRecord(accountID, zone.ID, "host."+domain, records.RecordTypeA, "10.0.0.1", 300)
+		require.NoError(t, s.CreateDNSRecord(ctx, record))
+	}
+
+	return zone
+}
+
+func TestCollectGroupChange_ZoneLinked(t *testing.T) {
+	_, s, accountID, _, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	createAffectedZone(t, s, accountID, affectedZoneDomain, true, true, []string{groupIDs[0]})
+
+	groups, _ := collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[0]})
+	assert.Contains(t, groups, groupIDs[0], "group distributed a zone should be affected by its own change")
+
+	groups, _ = collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[1]})
+	assert.Empty(t, groups, "group not referenced by any zone should not be affected")
+}
+
+func TestCollectGroupChange_UnshippedZoneNotLinked(t *testing.T) {
+	_, s, accountID, _, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	// Disabled zone and zone without records are never shipped by the network map.
+	createAffectedZone(t, s, accountID, "disabled."+affectedZoneDomain, false, true, []string{groupIDs[0]})
+	createAffectedZone(t, s, accountID, "empty."+affectedZoneDomain, true, false, []string{groupIDs[1]})
+
+	groups, _ := collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[0], groupIDs[1]})
+	assert.Empty(t, groups, "groups referenced only by unshipped zones should not be affected")
+}
+
+func TestResolveAffectedPeers_ZoneGroupMembershipChange(t *testing.T) {
+	_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+
+	createAffectedZone(t, s, accountID, affectedZoneDomain, true, true, []string{groupIDs[0]})
+
+	// Same change shape UpdateGroup builds: the group changed as a whole and peer1
+	// left it, so peer1 must refresh to drop the zone.
+	change := affectedpeers.Change{
+		ChangedGroupIDs:     []string{groupIDs[0]},
+		RemovedPeersByGroup: map[string][]string{groupIDs[0]: {peerIDs[1]}},
+	}
+
+	result := resolveAffected(t, s, accountID, change)
+	assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[1]}, result, "current and removed members of the zone group should be affected")
+}
+
+func TestResolveAffectedPeers_ZoneDistributionChange(t *testing.T) {
+	_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+
+	// Zone create/update/delete passes old and new distribution groups.
+	change := affectedpeers.Change{DistributionGroupIDs: []string{groupIDs[0], groupIDs[2]}}
+
+	result := resolveAffected(t, s, accountID, change)
+	assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[2]}, result, "only members of the distribution groups should be affected")
+}
+
+// TestAffectedPeers_ZoneGroupUpdate_NewMemberReceivesZone verifies that adding a peer
+// to a group referenced only by a zone pushes the zone to the new member and leaves
+// unrelated peers alone.
+func TestAffectedPeers_ZoneGroupUpdate_NewMemberReceivesZone(t *testing.T) {
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	zoneGroup := &types.Group{ID: "zone-grp", Name: "ZoneGroup", Peers: []string{peer1.ID}}
+	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, zoneGroup))
+
+	createAffectedZone(t, manager.Store, accountID, affectedZoneDomain, true, true, []string{zoneGroup.ID})
+
+	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	zoneGroup.Peers = []string{peer1.ID, peer2.ID}
+	require.NoError(t, manager.UpdateGroup(ctx, accountID, userID, zoneGroup))
+
+	peerShouldReceiveUpdate(t, updMsg1)
+	msg := receivePeerUpdate(t, updMsg2)
+	assert.True(t, syncHasCustomZone(msg, affectedZoneDomain+"."), "new zone group member should receive the zone")
+	peerShouldNotReceiveUpdate(t, updMsg3)
+}
+
+func receivePeerUpdate(t *testing.T, ch <-chan *network_map.UpdateMessage) *network_map.UpdateMessage {
+	t.Helper()
+	select {
+	case msg := <-ch:
+		require.NotNil(t, msg, "update message should not be nil")
+		return msg
+	case <-time.After(peerUpdateTimeout):
+		require.FailNow(t, "timed out waiting for update message")
+		return nil
+	}
+}
+
+func syncHasCustomZone(msg *network_map.UpdateMessage, domain string) bool {
+	for _, zone := range msg.Update.GetNetworkMap().GetDNSConfig().GetCustomZones() {
+		if zone.GetDomain() == domain {
+			return true
+		}
+	}
+	return false
+}

management/server/affectedpeers/resolver.go

@@ -22,6 +22,7 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -50,6 +51,7 @@ type Snapshot struct {
 	policies       []*types.Policy
 	routes         []*route.Route
 	nsGroups       []*nbdns.NameServerGroup
+	zones          []*zones.Zone
 	dnsSettings    *types.DNSSettings
 	routers        []*routerTypes.NetworkRouter
 	resources      []*resourceTypes.NetworkResource
@@ -127,12 +129,15 @@ func (snap *Snapshot) loadRoutesAndProxy(ctx context.Context, s store.Store, acc
 	return snap.loadProxyServices(ctx, s, accountID)
 }
 
-// loadDNS loads the nameserver groups and account DNS settings.
+// loadDNS loads the nameserver groups, custom DNS zones and account DNS settings.
 func (snap *Snapshot) loadDNS(ctx context.Context, s store.Store, accountID string) error {
 	var err error
 	if snap.nsGroups, err = s.GetAccountNameServerGroups(ctx, store.LockingStrengthNone, accountID); err != nil {
 		return err
 	}
+	if snap.zones, err = s.GetAccountZones(ctx, store.LockingStrengthNone, accountID); err != nil {
+		return err
+	}
 	snap.dnsSettings, err = s.GetAccountDNSSettings(ctx, store.LockingStrengthNone, accountID)
 	return err
 }
@@ -357,7 +362,7 @@ func (s policySide) opposite() policySide {
 //   - a changed router/resource/network sits on a NETWORK -> fold the SOURCE side of
 //     the policies whose destination reaches it (and the routers it implies).
 //
-// Routes, nameserver groups, DNS and embedded-proxy services distribute to their own
+// Routes, nameserver groups, DNS zones, DNS and embedded-proxy services distribute to their own
 // member peers, outside the policy graph, and are folded here too.
 func (r *resolver) walk() {
 	for _, policy := range r.bothSidesPolicies() {
@@ -369,6 +374,7 @@ func (r *resolver) walk() {
 		r.collectFromPolicies()
 		r.collectFromRoutes()
 		r.collectFromNameServers()
+		r.collectFromZones()
 		r.collectFromDNSSettings()
 		r.collectFromNetworkRouters()
 		r.collectFromProxyServices()
@@ -829,6 +835,25 @@ func (r *resolver) collectFromNameServers() {
 	}
 }
 
+// collectFromZones folds the distribution groups of the custom DNS zones that
+// reference a linked group. Like nameserver groups, a zone has no opposite side, so
+// only a whole-group change folds its groups. Zones the network map does not ship
+// (disabled or without records) are skipped.
+func (r *resolver) collectFromZones() {
+	if len(r.linkGroups) == 0 {
+		return
+	}
+	for _, zone := range r.snap.zones {
+		if !zone.Enabled || len(zone.Records) == 0 {
+			continue
+		}
+		if anyInSet(zone.DistributionGroups, r.linkGroups) {
+			log.WithContext(r.ctx).Tracef("collectFromZones: zone %s references a linked group -> folding its groups %v (outputGroups only)", zone.ID, zone.DistributionGroups)
+			r.foldOutputGroups(zone.DistributionGroups)
+		}
+	}
+}
+
 // collectFromSSHAuthorizedGroups folds the destinations of the enabled SSH rules that
 // authorize a group whose user membership changed. Those destination peers carry the
 // group -> user mapping for the groups they authorize, so they refresh even when no

management/server/api/v1alpha1/groups/helpers.go

@@ -0,0 +1,38 @@
+package groups
+
+import (
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+)
+
+func ToGroupsInfoMap(groups []*types.Group, idCount int) map[string][]apiv1alpha1.GroupMinimum {
+	groupsInfoMap := make(map[string][]apiv1alpha1.GroupMinimum, idCount)
+	groupsChecked := make(map[string]struct{}, len(groups)) // not sure why this is needed (left over from old implementation)
+	for _, group := range groups {
+		_, ok := groupsChecked[group.ID]
+		if ok {
+			continue
+		}
+
+		groupsChecked[group.ID] = struct{}{}
+		for _, pk := range group.Peers {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[pk] = append(groupsInfoMap[pk], info)
+		}
+		for _, rk := range group.Resources {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[rk.ID] = append(groupsInfoMap[rk.ID], info)
+		}
+	}
+	return groupsInfoMap
+}

management/server/api/v1alpha1/handler.go

@@ -0,0 +1,38 @@
+package v1alpha1
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/netbirdio/netbird/management/server/permissions"
+
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/peers"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/users"
+)
+
+func NewAPIV1Handler(
+	ctx context.Context,
+	router *mux.Router,
+	accountManager account.Manager,
+	networkMapController network_map.Controller,
+	permissionsManager permissions.Manager) (http.Handler, error) {
+
+	v1validatorMiddleware, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+	if err != nil {
+		return nil, err
+	}
+
+	router.Use(v1validatorMiddleware.Handler)
+
+	peersHandler := peers.NewHandler(accountManager, networkMapController, permissionsManager)
+	_ = peersHandler.WithEndpointsForRouter(router)
+
+	usersHandler := users.NewHandler(accountManager)
+	return usersHandler.WithEndpointsForRouter(router), nil
+}

management/server/api/v1alpha1/peers/peers_handler.go

@@ -0,0 +1,418 @@
+package peers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/netip"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/groups"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+type Handler struct {
+	accountManager       account.Manager
+	permissionsManager   permissions.Manager
+	networkMapController network_map.Controller
+}
+
+// NewHandler creates a new peers Handler
+func NewHandler(accountManager account.Manager, networkMapController network_map.Controller, permissionsManager permissions.Manager) *Handler {
+	return &Handler{
+		accountManager:       accountManager,
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/peers", h.GetAllPeers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/peers/{peerId}", h.HandlePeer).Methods("GET", "PUT", "DELETE", "OPTIONS")
+	return router
+}
+
+func (h *Handler) getPeer(ctx context.Context, accountID, peerID, userID string, w http.ResponseWriter) {
+	peer, err := h.accountManager.GetPeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	if peer.ProxyMeta.Embedded {
+		util.WriteError(ctx, status.Errorf(status.InvalidArgument, "not allowed to read peer"), w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetPeerGroups(ctx, accountID, peerID)
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to list approved peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(ctx, w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) updatePeer(ctx context.Context, accountID, userID, peerID string, w http.ResponseWriter, r *http.Request) {
+	req := &apiv1alpha1.PeerRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	update := &nbpeer.Peer{
+		ID:                          peerID,
+		SSHEnabled:                  req.SshEnabled,
+		Name:                        req.Name,
+		LoginExpirationEnabled:      req.LoginExpirationEnabled,
+		InactivityExpirationEnabled: req.InactivityExpirationEnabled,
+	}
+
+	if req.ApprovalRequired != nil {
+		// todo: looks like that we reset all status property, is it right?
+		update.Status = &nbpeer.PeerStatus{
+			RequiresApproval: *req.ApprovalRequired,
+		}
+	}
+
+	if req.Ip != nil {
+		addr, err := netip.ParseAddr(*req.Ip)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "invalid IP address %s: %v", *req.Ip, err), w)
+			return
+		}
+
+		if err = h.accountManager.UpdatePeerIP(ctx, accountID, userID, peerID, addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	if req.Ipv6 != nil {
+		v6Addr, err := parseIPv6(req.Ipv6)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "%v", err), w)
+			return
+		}
+		if err = h.accountManager.UpdatePeerIPv6(ctx, accountID, userID, peerID, v6Addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	peer, err := h.accountManager.UpdatePeer(ctx, accountID, userID, update)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	peerGroups, err := h.accountManager.GetPeerGroups(ctx, accountID, peer.ID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	grpsInfoMap := groups.ToGroupsInfoMap(peerGroups, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(r.Context(), w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) deletePeer(ctx context.Context, accountID, userID string, peerID string, w http.ResponseWriter) {
+	err := h.accountManager.DeletePeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete peer: %v", err)
+		util.WriteError(ctx, err, w)
+		return
+	}
+	util.WriteJSONObject(ctx, w, util.EmptyObject{})
+}
+
+// HandlePeer handles all peer requests for GET, PUT and DELETE operations
+func (h *Handler) HandlePeer(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	peerID := vars["peerId"]
+	if len(peerID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid peer ID"), w)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodDelete:
+		h.deletePeer(r.Context(), accountID, userID, peerID, w)
+		return
+	case http.MethodGet:
+		h.getPeer(r.Context(), accountID, peerID, userID, w)
+		return
+	case http.MethodPut:
+		h.updatePeer(r.Context(), accountID, userID, peerID, w, r)
+		return
+	default:
+		util.WriteError(r.Context(), status.Errorf(status.NotFound, "unknown METHOD"), w)
+	}
+}
+
+// GetAllPeers returns a list of all peers associated with a provided account
+func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	nameFilter := r.URL.Query().Get("name")
+	ipFilter := r.URL.Query().Get("ip")
+	macFilter := r.URL.Query().Get("mac")
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(r.Context(), accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetAllGroups(r.Context(), accountID, userID)
+
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, len(peers))
+	respBody := make([]*apiv1alpha1.PeerBatch, 0, len(peers))
+	for _, peer := range peers {
+		if peer.ProxyMeta.Embedded {
+			continue
+		}
+		respBody = append(respBody, toPeerListItemResponse(peer, grpsInfoMap[peer.ID], dnsDomain, 0))
+	}
+
+	validPeersMap, invalidPeersMap, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
+		return
+	}
+	h.setApprovalRequiredFlag(respBody, validPeersMap, invalidPeersMap)
+
+	util.WriteJSONObject(r.Context(), w, respBody)
+}
+
+func (h *Handler) setApprovalRequiredFlag(respBody []*apiv1alpha1.PeerBatch, validPeersMap map[string]struct{}, invalidPeersMap map[string]string) {
+	for _, peer := range respBody {
+		_, ok := validPeersMap[peer.Id]
+		if !ok {
+			peer.ApprovalRequired = true
+
+			reason := invalidPeersMap[peer.Id]
+			peer.DisapprovalReason = &reason
+		}
+	}
+}
+
+func parseIPv6(s *string) (netip.Addr, error) {
+	if s == nil {
+		return netip.Addr{}, fmt.Errorf("IPv6 address is nil")
+	}
+	addr, err := netip.ParseAddr(*s)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("invalid IPv6 address %s: %w", *s, err)
+	}
+	addr = addr.Unmap()
+	if !addr.Is6() {
+		return netip.Addr{}, fmt.Errorf("address %s is not IPv6", *s)
+	}
+	return addr, nil
+}
+
+func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, approved bool, reason string) *apiv1alpha1.Peer {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	apiPeer := &apiv1alpha1.Peer{
+		PeerMinimum: apiv1alpha1.PeerMinimum{
+			Id:   peer.ID,
+			Name: peer.Name,
+		},
+		CreatedAt:                   peer.CreatedAt,
+		Ip:                          peer.IP.String(),
+		Ipv6:                        peerIPv6String(peer),
+		ConnectionIp:                peer.Location.ConnectionIP.String(),
+		Connected:                   peer.Status.Connected,
+		LastSeen:                    peer.Status.LastSeen,
+		Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+		KernelVersion:               peer.Meta.KernelVersion,
+		GeonameId:                   int(peer.Location.GeoNameID),
+		Version:                     peer.Meta.WtVersion,
+		Groups:                      groupsInfo,
+		SshEnabled:                  peer.SSHEnabled,
+		Hostname:                    peer.Meta.Hostname,
+		UserId:                      peer.UserID,
+		UiVersion:                   peer.Meta.UIVersion,
+		DnsLabel:                    fqdn(peer, dnsDomain),
+		ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+		LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+		LastLogin:                   peer.GetLastLogin(),
+		LoginExpired:                peer.Status.LoginExpired,
+		ApprovalRequired:            !approved,
+		CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+		CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+		SerialNumber:                peer.Meta.SystemSerialNumber,
+		InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+		Ephemeral:                   peer.Ephemeral,
+		LocalFlags: &apiv1alpha1.PeerLocalFlags{
+			BlockInbound:          &peer.Meta.Flags.BlockInbound,
+			BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+			DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+			DisableDns:            &peer.Meta.Flags.DisableDNS,
+			DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+			DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+			LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+			RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+			RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+			ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+			RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+		},
+	}
+
+	if !approved {
+		apiPeer.DisapprovalReason = &reason
+	}
+
+	return apiPeer
+}
+
+func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, accessiblePeersCount int) *apiv1alpha1.PeerBatch {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	return &apiv1alpha1.PeerBatch{
+		CreatedAt:            peer.CreatedAt,
+		AccessiblePeersCount: accessiblePeersCount,
+		Peer: apiv1alpha1.Peer{
+			PeerMinimum: apiv1alpha1.PeerMinimum{
+				Id:   peer.ID,
+				Name: peer.Name,
+			},
+			Ip:                          peer.IP.String(),
+			Ipv6:                        peerIPv6String(peer),
+			ConnectionIp:                peer.Location.ConnectionIP.String(),
+			Connected:                   peer.Status.Connected,
+			LastSeen:                    peer.Status.LastSeen,
+			Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+			KernelVersion:               peer.Meta.KernelVersion,
+			GeonameId:                   int(peer.Location.GeoNameID),
+			Version:                     peer.Meta.WtVersion,
+			Groups:                      groupsInfo,
+			SshEnabled:                  peer.SSHEnabled,
+			Hostname:                    peer.Meta.Hostname,
+			UserId:                      peer.UserID,
+			UiVersion:                   peer.Meta.UIVersion,
+			DnsLabel:                    fqdn(peer, dnsDomain),
+			ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+			LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+			LastLogin:                   peer.GetLastLogin(),
+			LoginExpired:                peer.Status.LoginExpired,
+			CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+			CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+			SerialNumber:                peer.Meta.SystemSerialNumber,
+			InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+			Ephemeral:                   peer.Ephemeral,
+			LocalFlags: &apiv1alpha1.PeerLocalFlags{
+				BlockInbound:          &peer.Meta.Flags.BlockInbound,
+				BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+				DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+				DisableDns:            &peer.Meta.Flags.DisableDNS,
+				DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+				DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+				LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+				RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+				RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+				ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+				RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+			},
+		},
+	}
+}
+
+func fqdn(peer *nbpeer.Peer, dnsDomain string) string {
+	fqdn := peer.FQDN(dnsDomain)
+	if fqdn == "" {
+		return peer.DNSLabel
+	} else {
+		return fqdn
+	}
+}
+func fqdnList(extraLabels []string, dnsDomain string) []string {
+	fqdnList := make([]string, 0, len(extraLabels))
+	for _, label := range extraLabels {
+		fqdn := fmt.Sprintf("%s.%s", label, dnsDomain)
+		fqdnList = append(fqdnList, fqdn)
+	}
+	return fqdnList
+}
+
+func peerIPv6String(peer *nbpeer.Peer) *string {
+	if !peer.IPv6.IsValid() {
+		return nil
+	}
+	s := peer.IPv6.String()
+	return &s
+}

management/server/api/v1alpha1/peers/peers_handler_test.go

@@ -0,0 +1,445 @@
+package peers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"go.uber.org/mock/gomock"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/mock_server"
+)
+
+const (
+	testPeerID                = "test_peer"
+	noUpdateChannelTestPeerID = "no-update-channel"
+
+	adminUser   = "admin_user"
+	regularUser = "regular_user"
+	serviceUser = "service_user"
+)
+
+func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
+
+	peersMap := make(map[string]*nbpeer.Peer)
+	for _, peer := range peers {
+		peersMap[peer.ID] = peer.Copy()
+	}
+
+	policy := &types.Policy{
+		ID:        "policy",
+		AccountID: "test_id",
+		Name:      "policy",
+		Enabled:   true,
+		Rules: []*types.PolicyRule{
+			{
+				ID:            "rule",
+				Name:          "rule",
+				Enabled:       true,
+				Action:        "accept",
+				Destinations:  []string{"group1"},
+				Sources:       []string{"group1"},
+				Bidirectional: true,
+				Protocol:      "all",
+				Ports:         []string{"80"},
+			},
+		},
+	}
+
+	srvUser := types.NewRegularUser(serviceUser, "", "")
+	srvUser.IsServiceUser = true
+
+	account := &types.Account{
+		Id:     "test_id",
+		Domain: "hotmail.com",
+		Peers:  peersMap,
+		Users: map[string]*types.User{
+			adminUser:   types.NewAdminUser(adminUser),
+			regularUser: types.NewRegularUser(regularUser, "", ""),
+			serviceUser: srvUser,
+		},
+		Groups: map[string]*types.Group{
+			"group1": {
+				ID:        "group1",
+				AccountID: "test_id",
+				Name:      "group1",
+				Issued:    "api",
+				Peers:     maps.Keys(peersMap),
+			},
+		},
+		Settings: &types.Settings{
+			PeerLoginExpirationEnabled: true,
+			PeerLoginExpiration:        time.Hour,
+		},
+		Policies: []*types.Policy{policy},
+		Network: &types.Network{
+			Identifier: "ciclqisab2ss43jdn8q0",
+			Net: net.IPNet{
+				IP:   net.ParseIP("100.67.0.0"),
+				Mask: net.IPv4Mask(255, 255, 0, 0),
+			},
+			Serial: 51,
+		},
+	}
+
+	ctrl := gomock.NewController(t)
+
+	networkMapController := network_map.NewMockController(ctrl)
+	networkMapController.EXPECT().
+		GetDNSDomain(gomock.Any()).
+		Return("domain").
+		AnyTimes()
+
+	ctrl2 := gomock.NewController(t)
+	permissionsManager := permissions.NewMockManager(ctrl2)
+	permissionsManager.EXPECT().ValidateAccountAccess(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(context.Background(), nil).AnyTimes()
+	permissionsManager.EXPECT().
+		ValidateUserPermissions(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).
+		DoAndReturn(func(ctx context.Context, accountID, userID string, module modules.Module, operation operations.Operation) (bool, context.Context, error) {
+			user, ok := account.Users[userID]
+			if !ok {
+				return false, ctx, fmt.Errorf("user not found")
+			}
+			return user.HasAdminPower() || user.IsServiceUser, ctx, nil
+		}).
+		AnyTimes()
+
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			UpdatePeerFunc: func(_ context.Context, accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if update.ID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				p.SSHEnabled = update.SSHEnabled
+				p.LoginExpirationEnabled = update.LoginExpirationEnabled
+				p.Name = update.Name
+				return p, nil
+			},
+			UpdatePeerIPFunc: func(_ context.Context, accountID, userID, peerID string, newIP netip.Addr) error {
+				for _, peer := range peers {
+					if peer.ID == peerID {
+						peer.IP = newIP
+						return nil
+					}
+				}
+				return fmt.Errorf("peer not found")
+			},
+			GetPeerFunc: func(_ context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if peerID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				return p, nil
+			},
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				switch id {
+				case adminUser:
+					return account.Users[adminUser], nil
+				case regularUser:
+					return account.Users[regularUser], nil
+				case serviceUser:
+					return account.Users[serviceUser], nil
+				default:
+					return nil, fmt.Errorf("user not found")
+				}
+			},
+			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
+				return peers, nil
+			},
+			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
+				peersID := make([]string, len(peers))
+				for _, peer := range peers {
+					peersID = append(peersID, peer.ID)
+				}
+				return []*types.Group{
+					{
+						ID:        "group1",
+						AccountID: accountID,
+						Name:      "group1",
+						Issued:    "api",
+						Peers:     peersID,
+					},
+				}, nil
+			},
+			GetDNSDomainFunc: func(settings *types.Settings) string {
+				return "netbird.selfhosted"
+			},
+			GetAccountFunc: func(ctx context.Context, accountID string) (*types.Account, error) {
+				return account, nil
+			},
+			GetAccountByIDFunc: func(ctx context.Context, accountID string, userID string) (*types.Account, error) {
+				return account, nil
+			},
+			HasConnectedChannelFunc: func(peerID string) bool {
+				statuses := make(map[string]struct{})
+				for _, peer := range peers {
+					if peer.ID == noUpdateChannelTestPeerID {
+						break
+					}
+					statuses[peer.ID] = struct{}{}
+				}
+				_, ok := statuses[peerID]
+				return ok
+			},
+			GetAccountSettingsFunc: func(ctx context.Context, accountID string, userID string) (*types.Settings, error) {
+				return account.Settings, nil
+			},
+		},
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+// Tests the GetAllPeers endpoint reachable in the route /api/peers
+// Use the metadata generated by initTestMetaData() to check for values
+func TestGetPeers(t *testing.T) {
+
+	peer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: true},
+		Name:                   "PeerName",
+		LoginExpirationEnabled: false,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:           "hostname",
+			GoOS:               "GoOS",
+			Kernel:             "kernel",
+			Core:               "core",
+			Platform:           "platform",
+			OS:                 "OS",
+			WtVersion:          "development",
+			SystemSerialNumber: "C02XJ0J0JGH7",
+		},
+	}
+
+	peer1 := peer.Copy()
+	peer1.ID = noUpdateChannelTestPeerID
+
+	expectedUpdatedPeer := peer.Copy()
+	expectedUpdatedPeer.LoginExpirationEnabled = true
+	expectedUpdatedPeer.SSHEnabled = true
+	expectedUpdatedPeer.Name = "New Name"
+
+	expectedPeer1 := peer1.Copy()
+	expectedPeer1.Status.Connected = false
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		contentType    string
+		requestBody    io.Reader
+		expectedArray  bool
+		expectedPeer   *nbpeer.Peer
+	}{
+		{
+			name:           "GetPeersMetaData",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			expectedArray:  true,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "GetPeer with update channel",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers/" + testPeerID,
+			expectedStatus: http.StatusOK,
+			expectedArray:  false,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "PutPeer",
+			requestType:    http.MethodPut,
+			requestPath:    "/peers/" + testPeerID,
+			contentType:    "application/json",
+			expectedStatus: http.StatusOK,
+			expectedArray:  false,
+			requestBody:    bytes.NewBufferString("{\"login_expiration_enabled\":true,\"name\":\"New Name\",\"ssh_enabled\":true, \"inactivity_expiration_enabled\":true}"),
+			expectedPeer:   expectedUpdatedPeer,
+		},
+	}
+
+	p := initTestMetaData(t, peer, peer1)
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			var got *apiv1alpha1.Peer
+			if tc.expectedArray {
+				respBody := []*apiv1alpha1.Peer{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("Sent content is not in correct json format; %v", err)
+				}
+
+				// hardcode this check for now as we only have two peers in this suite
+				assert.Equal(t, len(respBody), 2)
+
+				for _, peer := range respBody {
+					if peer.Id == testPeerID {
+						got = peer
+					}
+				}
+
+			} else {
+				got = &apiv1alpha1.Peer{}
+				err = json.Unmarshal(content, got)
+				if err != nil {
+					t.Fatalf("Sent content is not in correct json format; %v", err)
+				}
+			}
+
+			t.Log(got)
+
+			assert.Equal(t, tc.expectedPeer.Name, got.Name)
+			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)
+			assert.Equal(t, tc.expectedPeer.IP.String(), got.Ip)
+			assert.Equal(t, "OS core", got.Os)
+			assert.Equal(t, tc.expectedPeer.LoginExpirationEnabled, got.LoginExpirationEnabled)
+			assert.Equal(t, tc.expectedPeer.SSHEnabled, got.SshEnabled)
+			assert.Equal(t, tc.expectedPeer.Status.Connected, got.Connected)
+			assert.Equal(t, tc.expectedPeer.Meta.SystemSerialNumber, got.SerialNumber)
+		})
+	}
+}
+
+func TestPeersHandlerUpdatePeerIP(t *testing.T) {
+	testPeer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now()},
+		Name:                   "test-host@netbird.io",
+		LoginExpirationEnabled: false,
+		UserID:                 regularUser,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname: "test-host@netbird.io",
+			Core:     "22.04",
+		},
+	}
+
+	p := initTestMetaData(t, testPeer)
+
+	tt := []struct {
+		name           string
+		peerID         string
+		requestBody    string
+		callerUserID   string
+		expectedStatus int
+		expectedIP     string
+	}{
+		{
+			name:           "update peer IP successfully",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "100.64.0.100"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusOK,
+			expectedIP:     "100.64.0.100",
+		},
+		{
+			name:           "update peer IP with invalid IP",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "invalid-ip"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusUnprocessableEntity,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/peers/%s", tc.peerID), bytes.NewBuffer([]byte(tc.requestBody)))
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    tc.callerUserID,
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			assert.Equal(t, tc.expectedStatus, rr.Code)
+
+			if tc.expectedStatus == http.StatusOK && tc.expectedIP != "" {
+				var updatedPeer apiv1alpha1.Peer
+				err := json.Unmarshal(rr.Body.Bytes(), &updatedPeer)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedIP, updatedPeer.Ip)
+			}
+		})
+	}
+}

management/server/api/v1alpha1/users/users_handler.go

@@ -0,0 +1,275 @@
+package users
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+)
+
+type Handler struct {
+	accountManager account.Manager
+}
+
+func NewHandler(accountManager account.Manager) *Handler {
+	return &Handler{
+		accountManager: accountManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/users", h.getAllUsers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/users", h.createUser).Methods("POST", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.updateUser).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.deleteUser).Methods("DELETE", "OPTIONS")
+	return router
+}
+
+// updateUser is a PUT requests to update User data
+func (h *Handler) updateUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	existingUser, err := h.accountManager.GetUserByID(r.Context(), targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	req := &apiv1alpha1.UserRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if req.AutoGroups == nil {
+		util.WriteErrorResponse("auto_groups field can't be absent", http.StatusBadRequest, w)
+		return
+	}
+
+	userRole := types.StrRoleToUserRole(req.Role)
+	if userRole == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user role"), w)
+		return
+	}
+
+	newUser, err := h.accountManager.SaveUser(r.Context(), accountID, userID, &types.User{
+		Id:                   targetUserID,
+		Role:                 userRole,
+		AutoGroups:           req.AutoGroups,
+		Blocked:              req.IsBlocked,
+		Issued:               existingUser.Issued,
+		IntegrationReference: existingUser.IntegrationReference,
+	})
+
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// deleteUser is a DELETE request to delete a user
+func (h *Handler) deleteUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	err = h.accountManager.DeleteUser(r.Context(), accountID, userID, targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+// createUser creates a User in the system with a status "invited" (effectively this is a user invite).
+func (h *Handler) createUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	req := &apiv1alpha1.UserCreateRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if types.StrRoleToUserRole(req.Role) == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "unknown user role %s", req.Role), w)
+		return
+	}
+
+	email := ""
+	if req.Email != nil {
+		email = *req.Email
+	}
+
+	name := ""
+	if req.Name != nil {
+		name = *req.Name
+	}
+
+	newUser, err := h.accountManager.CreateUser(r.Context(), accountID, userID, &types.UserInfo{
+		Email:         email,
+		Name:          name,
+		Role:          req.Role,
+		AutoGroups:    req.AutoGroups,
+		IsServiceUser: req.IsServiceUser,
+		Issued:        types.UserIssuedAPI,
+	})
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// getAllUsers returns a list of users of the account this user belongs to.
+// It also gathers additional user data (like email and name) from the IDP manager.
+func (h *Handler) getAllUsers(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	data, err := h.accountManager.GetUsersFromAccount(r.Context(), accountID, userID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	serviceUser := r.URL.Query().Get("service_user")
+
+	users := make([]*apiv1alpha1.User, 0)
+	for _, d := range data {
+		if d.NonDeletable {
+			continue
+		}
+		if serviceUser == "" {
+			users = append(users, toUserResponse(d, userID))
+			continue
+		}
+
+		includeServiceUser, err := strconv.ParseBool(serviceUser)
+		log.WithContext(r.Context()).Tracef("Should include service user: %v", includeServiceUser)
+		if err != nil {
+			util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid service_user query parameter"), w)
+			return
+		}
+		if includeServiceUser == d.IsServiceUser {
+			users = append(users, toUserResponse(d, userID))
+		}
+	}
+
+	util.WriteJSONObject(r.Context(), w, users)
+}
+
+func toUserResponse(user *types.UserInfo, currenUserID string) *apiv1alpha1.User {
+	autoGroups := user.AutoGroups
+	if autoGroups == nil {
+		autoGroups = []string{}
+	}
+
+	var userStatus apiv1alpha1.UserStatus
+	switch user.Status {
+	case "active":
+		userStatus = apiv1alpha1.UserStatusActive
+	case "invited":
+		userStatus = apiv1alpha1.UserStatusInvited
+	default:
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	if user.IsBlocked {
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	isCurrent := user.ID == currenUserID
+
+	var password *string
+	if user.Password != "" {
+		password = &user.Password
+	}
+
+	var idpID *string
+	if user.IdPID != "" {
+		idpID = &user.IdPID
+	}
+
+	return &apiv1alpha1.User{
+		Id:              user.ID,
+		Name:            user.Name,
+		Email:           user.Email,
+		Role:            user.Role,
+		AutoGroups:      autoGroups,
+		Status:          userStatus,
+		IsCurrent:       &isCurrent,
+		IsServiceUser:   &user.IsServiceUser,
+		IsBlocked:       user.IsBlocked,
+		LastLogin:       &user.LastLogin,
+		Issued:          &user.Issued,
+		PendingApproval: user.PendingApproval,
+		Password:        password,
+		IdpId:           idpID,
+	}
+}

management/server/api/v1alpha1/users/users_handler_test.go

@@ -0,0 +1,452 @@
+package users
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	existingAccountID         = "existingAccountID"
+	notFoundAccountID         = "notFoundAccountID"
+	testDomain                = "hotmail.com"
+	existingUserID            = "existingUserID"
+	notFoundUserID            = "notFoundUserID"
+	serviceUserID             = "serviceUserID"
+	nonDeletableServiceUserID = "nonDeletableServiceUserID"
+	regularUserID             = "regularUserID"
+)
+
+var usersTestAccount = &types.Account{
+	Id:     existingAccountID,
+	Domain: testDomain,
+	Users: map[string]*types.User{
+		existingUserID: {
+			Id:            existingUserID,
+			Role:          "admin",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		regularUserID: {
+			Id:            regularUserID,
+			Role:          "user",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		serviceUserID: {
+			Id:            serviceUserID,
+			Role:          "user",
+			IsServiceUser: true,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		nonDeletableServiceUserID: {
+			Id:            nonDeletableServiceUserID,
+			Role:          "admin",
+			IsServiceUser: true,
+			NonDeletable:  true,
+			Issued:        types.UserIssuedIntegration,
+		},
+	},
+}
+
+func initUsersTestData() *Handler {
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				return usersTestAccount.Users[id], nil
+			},
+			GetUsersFromAccountFunc: func(_ context.Context, accountID, userID string) (map[string]*types.UserInfo, error) {
+				usersInfos := make(map[string]*types.UserInfo)
+				for _, v := range usersTestAccount.Users {
+					usersInfos[v.Id] = &types.UserInfo{
+						ID:            v.Id,
+						Role:          string(v.Role),
+						Name:          "",
+						Email:         "",
+						IsServiceUser: v.IsServiceUser,
+						NonDeletable:  v.NonDeletable,
+						Issued:        v.Issued,
+					}
+				}
+				return usersInfos, nil
+			},
+			CreateUserFunc: func(_ context.Context, accountID, userID string, key *types.UserInfo) (*types.UserInfo, error) {
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+				return key, nil
+			},
+			DeleteUserFunc: func(_ context.Context, accountID string, initiatorUserID string, targetUserID string) error {
+				if targetUserID == notFoundUserID {
+					return status.Errorf(status.NotFound, "user with ID %s does not exists", targetUserID)
+				}
+				if !usersTestAccount.Users[targetUserID].IsServiceUser {
+					return status.Errorf(status.PermissionDenied, "user with ID %s is not a service user and can not be deleted", targetUserID)
+				}
+				return nil
+			},
+			SaveUserFunc: func(_ context.Context, accountID, userID string, update *types.User) (*types.UserInfo, error) {
+				if update.Id == notFoundUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", update.Id)
+				}
+
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+
+				info, err := update.Copy().ToUserInfo(nil)
+				if err != nil {
+					return nil, err
+				}
+				return info, nil
+			},
+		},
+	}
+}
+
+func TestGetUsers(t *testing.T) {
+	tt := []struct {
+		name            string
+		expectedStatus  int
+		requestType     string
+		requestPath     string
+		expectedUserIDs []string
+	}{
+		{name: "getAllUsers", requestType: http.MethodGet, requestPath: "/users", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID, serviceUserID}},
+		{name: "GetOnlyServiceUsers", requestType: http.MethodGet, requestPath: "/users?service_user=true", expectedStatus: http.StatusOK, expectedUserIDs: []string{serviceUserID}},
+		{name: "GetOnlyRegularUsers", requestType: http.MethodGet, requestPath: "/users?service_user=false", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID}},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Errorf("handler returned wrong status code: got %v want %v, content: %s",
+					status, tc.expectedStatus, string(content))
+				return
+			}
+
+			respBody := []*types.UserInfo{}
+			err = json.Unmarshal(content, &respBody)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, len(respBody), len(tc.expectedUserIDs))
+			for _, v := range respBody {
+				assert.Contains(t, tc.expectedUserIDs, v.ID)
+				assert.Equal(t, v.ID, usersTestAccount.Users[v.ID].Id)
+				assert.Equal(t, v.Role, string(usersTestAccount.Users[v.ID].Role))
+				assert.Equal(t, v.IsServiceUser, usersTestAccount.Users[v.ID].IsServiceUser)
+				assert.Equal(t, v.Issued, usersTestAccount.Users[v.ID].Issued)
+			}
+		})
+	}
+}
+
+func TestUpdateUser(t *testing.T) {
+	tt := []struct {
+		name                  string
+		expectedStatusCode    int
+		requestType           string
+		requestPath           string
+		requestBody           io.Reader
+		expectedUserID        string
+		expectedRole          string
+		expectedStatus        string
+		expectedBlocked       bool
+		expectedIsServiceUser bool
+		expectedGroups        []string
+	}{
+		{
+			name:               "Update_Block_User",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    true,
+			expectedRole:       "user",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"user\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": true}"),
+		},
+		{
+			name:               "Update_Change_Role_To_Admin",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Update_Groups",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_3\", \"group_2\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Should_Fail_Because_AutoGroups_Is_Absent",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusUnprocessableEntity,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatusCode {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			if tc.expectedStatusCode == 200 {
+
+				content, err := io.ReadAll(res.Body)
+				if err != nil {
+					t.Fatalf("I don't know what I expected; %v", err)
+				}
+
+				respBody := &apiv1alpha1.User{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("response content is not in correct json format; %v", err)
+				}
+
+				assert.Equal(t, tc.expectedUserID, respBody.Id)
+				assert.Equal(t, tc.expectedRole, respBody.Role)
+				assert.Equal(t, tc.expectedIsServiceUser, *respBody.IsServiceUser)
+				assert.Equal(t, tc.expectedBlocked, respBody.IsBlocked)
+				assert.Len(t, respBody.AutoGroups, len(tc.expectedGroups))
+
+				for _, expectedGroup := range tc.expectedGroups {
+					exists := false
+					for _, actualGroup := range respBody.AutoGroups {
+						if expectedGroup == actualGroup {
+							exists = true
+						}
+					}
+					assert.True(t, exists, fmt.Sprintf("group %s not found in the response", expectedGroup))
+				}
+			}
+		})
+	}
+}
+
+func TestCreateUser(t *testing.T) {
+	name := "name"
+	email := "email"
+	serviceUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         nil,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	serviceUserString, err := json.Marshal(serviceUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	regularUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         &email,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	regularUserString, err := json.Marshal(regularUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		requestBody    io.Reader
+		expectedResult []*types.User
+	}{
+		{name: "CreateServiceUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(serviceUserString)},
+		// right now creation is blocked in AC middleware, will be refactored in the future
+		{name: "CreateRegularUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(regularUserString)},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			rr := httptest.NewRecorder()
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			req.Header.Set("Content-Type", "application/json")
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}
+
+func TestDeleteUser(t *testing.T) {
+	tt := []struct {
+		name           string
+		expectedStatus int
+		expectedBody   bool
+		requestType    string
+		requestPath    string
+		requestVars    map[string]string
+		requestBody    io.Reader
+	}{
+		{
+			name:           "Delete Regular User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + regularUserID,
+			requestVars:    map[string]string{"userId": regularUserID},
+			expectedStatus: http.StatusForbidden,
+		},
+		{
+			name:           "Delete Service User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + serviceUserID,
+			requestVars:    map[string]string{"userId": serviceUserID},
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "Delete Not Existing User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + notFoundUserID,
+			requestVars:    map[string]string{"userId": notFoundUserID},
+			expectedStatus: http.StatusNotFound,
+		},
+	}
+
+	userHandler := initUsersTestData()
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = mux.SetURLVars(req, tc.requestVars)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}

management/server/auth/session.go

@@ -3,9 +3,11 @@ package auth
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 )
 
@@ -52,6 +54,22 @@ func (s *SessionStore) RegisterToken(ctx context.Context, token string, expiresA
 }
 
 func hashToken(token string) string {
-	sum := sha256.Sum256([]byte(token))
+	sum := sha256.Sum256([]byte(canonicalizeToken(token)))
 	return hex.EncodeToString(sum[:])
 }
+
+// canonicalizeToken re-encodes the JWT signature segment so noncanonical
+// spellings of the same signature map to one stable cache key.
+func canonicalizeToken(token string) string {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return token
+	}
+
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return token
+	}
+
+	return parts[0] + "." + parts[1] + "." + base64.RawURLEncoding.EncodeToString(sig)
+}

management/server/auth/session_test.go

@@ -2,10 +2,15 @@ package auth
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
 	"errors"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -131,3 +136,49 @@ func TestHashToken_StableAndDoesNotLeak(t *testing.T) {
 	assert.Len(t, a, 64, "sha256 hex must be 64 chars")
 	assert.NotContains(t, a, "tokenA", "raw token must not appear in hash")
 }
+
+func TestSessionStore_NoncanonicalSpellingIsRejectedAsReplay(t *testing.T) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
+		"sub": "user",
+		"exp": time.Now().Add(time.Hour).Unix(),
+	})
+	canonical, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	parts := strings.Split(canonical, ".")
+	require.Len(t, parts, 3)
+
+	// A 256-byte RSA signature (256 mod 3 == 1) leaves unused bits in the final
+	// base64url character; flip one without changing the decoded signature.
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+	last := strings.IndexByte(alphabet, parts[2][len(parts[2])-1])
+	require.GreaterOrEqual(t, last, 0)
+	require.Equal(t, 0, last&3, "unexpected canonical RSA signature encoding")
+
+	equivalentSig := parts[2][:len(parts[2])-1] + string(alphabet[last|1])
+	equivalent := parts[0] + "." + parts[1] + "." + equivalentSig
+	require.NotEqual(t, canonical, equivalent, "spellings must differ as strings")
+
+	// Same decoded signature bytes, so they verify as the same JWT.
+	canonicalSig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	require.NoError(t, err)
+	altSig, err := base64.RawURLEncoding.DecodeString(equivalentSig)
+	require.NoError(t, err)
+	require.Equal(t, canonicalSig, altSig, "spellings must decode to identical signature bytes")
+
+	// The replay-cache key must be identical for both spellings.
+	assert.Equal(t, hashToken(canonical), hashToken(equivalent),
+		"noncanonical spelling must map to the same replay-cache key")
+
+	s := newTestSessionStore(t)
+	ctx := context.Background()
+	exp := time.Now().Add(time.Hour)
+
+	require.NoError(t, s.RegisterToken(ctx, canonical, exp), "first claim should succeed")
+	err = s.RegisterToken(ctx, equivalent, exp)
+	require.Error(t, err, "alternate spelling must be treated as a replay")
+	assert.ErrorIs(t, err, ErrTokenAlreadyUsed)
+}

management/server/cache/idp.go

@@ -88,7 +88,8 @@ func NewUserDataCache(store store.StoreInterface) *UserDataCacheImpl {
 
 // AccountUserDataCache wraps the basic Get, Set and Delete methods for []*idp.UserData objects.
 type AccountUserDataCache struct {
-	cache Marshaler
+	cache    Marshaler
+	loadable *cache.LoadableCache[any]
 }
 
 func (a *AccountUserDataCache) Get(ctx context.Context, key string) ([]*idp.UserData, error) {
@@ -127,13 +128,18 @@ func (a *AccountUserDataCache) Delete(ctx context.Context, key string) error {
 	return a.cache.Delete(ctx, key)
 }
 
+// Close stops the goroutine that stores loaded values. The cache must not be used afterwards.
+func (a *AccountUserDataCache) Close() error {
+	return a.loadable.Close()
+}
+
 // NewAccountUserDataCache creates a new AccountUserDataCache object.
 func NewAccountUserDataCache(loadableFunc cache.LoadFunction[any], store store.StoreInterface) *AccountUserDataCache {
 	simpleCache := cache.New[any](store)
 	loadable := cache.NewLoadable[any](loadableFunc, simpleCache)
 	if store.GetType() == redis.RedisType {
 		m := marshaler.New(loadable)
-		return &AccountUserDataCache{cache: m}
+		return &AccountUserDataCache{cache: m, loadable: loadable}
 	}
-	return &AccountUserDataCache{cache: &marshalerWraper{loadable}}
+	return &AccountUserDataCache{cache: &marshalerWraper{loadable}, loadable: loadable}
 }

management/server/dns_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -16,7 +16,6 @@ import (
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -234,9 +233,9 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createDNSStore(t *testing.T) (store.Store, error) {
@@ -363,163 +362,167 @@ func initTestDNSAccount(t *testing.T, am *DefaultAccountManager) (*types.Account
 }
 
 func TestDNSAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
-	t.Run("saving dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+		err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
 		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have no peers should not update account peers or send peer update
-	t.Run("creating dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("creating dns setting with used groups", func(t *testing.T) {
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
+		step(t, "saving dns setting with unused groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
 
-	// Saving DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("saving dns setting with used groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA", "groupB"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have no peers should not update account peers or send peer update
+		step(t, "creating dns setting with unused groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
-	t.Run("removing group with no peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "creating dns setting with used groups", func(t *testing.T) {
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
 
-	// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
-	t.Run("removing group with peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{},
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Saving DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "saving dns setting with used groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA", "groupB"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
+		step(t, "removing group with no peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
+		step(t, "removing group with peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }

management/server/group.go

@@ -166,9 +166,11 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		// A membership change does not alter which entities reference the group, so
 		// the dependency walk runs once against the post-change snapshot. The new
@@ -321,7 +323,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	var globalErr error
 	for _, newGroup := range groups {
 		change := affectedpeers.Change{ChangedGroupIDs: []string{newGroup.ID}}
-		events, snap, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
+		events, snap, change, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to update group %s: %v", newGroup.ID, err)
 			if len(groups) == 1 {
@@ -344,7 +346,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	return globalErr
 }
 
-func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, error) {
+func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, affectedpeers.Change, error) {
 	var events []func()
 	var snap *affectedpeers.Snapshot
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -364,9 +366,11 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		if err := transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return err
@@ -377,7 +381,7 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 		return err
 	})
-	return events, snap, err
+	return events, snap, change, err
 }
 
 // prepareGroupEvents prepares a list of event functions to be stored.
@@ -480,8 +484,8 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 	var allErrors error
 	var groupIDsToDelete []string
 	var deletedGroups []*types.Group
-	var snap *affectedpeers.Snapshot
-	var change affectedpeers.Change
+	var snap, ipv6Snap *affectedpeers.Snapshot
+	var change, ipv6Change affectedpeers.Change
 
 	extraSettings, err := am.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
@@ -510,10 +514,20 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete)
+		if err != nil {
 			return err
 		}
 
+		// Members of a deleted IPv6-enabled group lose their address, which the
+		// pre-delete snapshot cannot see, so they are resolved post-delete.
+		if len(ipv6Changed) > 0 {
+			ipv6Change = affectedpeers.Change{ChangedPeerIDs: ipv6Changed}
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return err
+			}
+		}
+
 		return transaction.IncrementNetworkSerial(ctx, accountID)
 	})
 	if err != nil {
@@ -524,7 +538,7 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 		am.StoreEvent(ctx, userID, group.ID, accountID, activity.GroupDeleted, group.EventMeta())
 	}
 
-	am.ExpandAndUpdateAffected(ctx, accountID, snap, change)
+	go am.dispatchAffected(ctx, accountID, []*affectedpeers.Snapshot{snap, ipv6Snap}, []affectedpeers.Change{change, ipv6Change})
 
 	return allErrors
 }
@@ -564,11 +578,14 @@ func (am *DefaultAccountManager) GroupAddPeer(ctx context.Context, accountID, gr
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}
@@ -634,11 +651,14 @@ func (am *DefaultAccountManager) GroupDeletePeer(ctx context.Context, accountID,
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}

management/server/group_test.go

@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -685,342 +686,368 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 }
 
 func TestGroupAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving a group that is not linked to any resource should not update account peers
-	t.Run("saving unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding a peer to a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Removing a peer from a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("removing peer from unliked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting group should not update account peers and not send peer update
-	t.Run("deleting group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// adding a group to policy
-	_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID},
 			},
-		},
-	}, true)
-	assert.NoError(t, err)
-
-	// Saving a group linked to policy should update account peers and send peer update
-	t.Run("saving linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// adding peer to a used group should update account peers and send peer update
-	t.Run("adding peer to linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// removing peer from a linked group should update account peers and send peer update
-	t.Run("removing peer from linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+		// Saving a group that is not linked to any resource should not update account peers
+		step(t, "saving unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding a peer to a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing a peer from a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "removing peer from unliked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting group should not update account peers and not send peer update
+		step(t, "deleting group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// adding a group to policy
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to policy should update account peers and send peer update
+		step(t, "saving linked group to policy", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-	// Saving a group linked to name server group should update account peers and send peer update
-	t.Run("saving group linked to name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
 
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// adding peer to a used group should update account peers and send peer update
+		step(t, "adding peer to linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to route should update account peers and send peer update
-	t.Run("saving group linked to route", func(t *testing.T) {
-		newRoute := route.Route{
-			ID:          "route",
-			Network:     netip.MustParsePrefix("192.168.0.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// removing peer from a linked group should update account peers and send peer update
+		step(t, "removing peer from linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to dns settings should update account peers and send peer update
-	t.Run("saving group linked to dns settings", func(t *testing.T) {
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupD"},
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to name server group should update account peers and send peer update
+		step(t, "saving group linked to name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID},
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to route should update account peers and send peer update
+		step(t, "saving group linked to route", func(t *testing.T) {
+			newRoute := route.Route{
+				ID:          "route",
+				Network:     netip.MustParsePrefix("192.168.0.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
 
-	// Saving a group linked to network router should update account peers and send peer update
-	t.Run("saving group linked to network router", func(t *testing.T) {
-		permissionsManager := permissions.NewManager(manager.Store)
-		groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
-		resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
-		routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
-		networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
+			settleAffectedUpdates(updMsg)
 
-		network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
-			ID:          "network_test",
-			AccountID:   account.Id,
-			Name:        "network_test",
-			Description: "",
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
-			ID:         "router_test",
-			NetworkID:  network.ID,
-			AccountID:  account.Id,
-			PeerGroups: []string{"groupE"},
-			Masquerade: true,
-			Metric:     9999,
-			Enabled:    true,
+		// Saving a group linked to dns settings should update account peers and send peer update
+		step(t, "saving group linked to dns settings", func(t *testing.T) {
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupD"},
+			})
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to network router should update account peers and send peer update
+		step(t, "saving group linked to network router", func(t *testing.T) {
+			permissionsManager := permissions.NewManager(manager.Store)
+			groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
+			resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
+			routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
+			networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID, peer3.ID},
+			network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
+				ID:          "network_test",
+				AccountID:   account.Id,
+				Name:        "network_test",
+				Description: "",
+			})
+			require.NoError(t, err)
+
+			_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
+				ID:         "router_test",
+				NetworkID:  network.ID,
+				AccountID:  account.Id,
+				PeerGroups: []string{"groupE"},
+				Masquerade: true,
+				Metric:     9999,
+				Enabled:    true,
+			})
+			require.NoError(t, err)
+
+			resource, err := resourcesManager.CreateResource(context.Background(), userID, &resourceTypes.NetworkResource{
+				AccountID: account.Id,
+				NetworkID: network.ID,
+				Name:      "resource_test",
+				Address:   "10.20.30.0/24",
+				Enabled:   true,
+			})
+			require.NoError(t, err)
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, peerToResourcePolicyByResource("groupA", resource.ID), true)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
 	})
 }
 

management/server/http/handler.go

@@ -7,8 +7,6 @@ import (
 	"net/netip"
 
 	"github.com/gorilla/mux"
-	"github.com/rs/cors"
-	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 
@@ -36,7 +34,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/http/handlers/proxy"
 
-	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	nbgroups "github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/http/handlers/accounts"
@@ -51,17 +48,20 @@ import (
 	"github.com/netbirdio/netbird/management/server/http/handlers/routes"
 	"github.com/netbirdio/netbird/management/server/http/handlers/setup_keys"
 	"github.com/netbirdio/netbird/management/server/http/handlers/users"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/middleware/bypass"
 	nbinstance "github.com/netbirdio/netbird/management/server/instance"
 	nbnetworks "github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
-	"github.com/netbirdio/netbird/management/server/telemetry"
 )
 
 // NewAPIHandler creates the Management service HTTP API handler registering all the available endpoints.
-func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager, resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation, authManager auth.Manager, appMetrics telemetry.AppMetrics, permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager, networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager, reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer, trustedHTTPProxies []netip.Prefix, rateLimiter *middleware.APIRateLimiter, isValidChildAccount middleware.IsValidChildAccountFunc, agentNetworkManager agentnetwork.Manager) (http.Handler, error) {
+func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager,
+	resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation,
+	permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager,
+	networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager,
+	reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer,
+	trustedHTTPProxies []netip.Prefix, agentNetworkManager agentnetwork.Manager, proxyTokenRevocationGuard proxytoken.RevocationGuard) (http.Handler, error) {
 
 	// Register bypass paths for unauthenticated endpoints
 	if err := bypass.AddBypassPath("/api/instance"); err != nil {
@@ -82,28 +82,6 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		return nil, fmt.Errorf("failed to add bypass path: %w", err)
 	}
 
-	if rateLimiter == nil {
-		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
-		rateLimiter = middleware.NewAPIRateLimiter(nil)
-		rateLimiter.SetEnabled(false)
-	}
-
-	authMiddleware := middleware.NewAuthMiddleware(
-		authManager,
-		accountManager.GetAccountIDFromUserAuth,
-		accountManager.SyncUserJWTGroups,
-		accountManager.GetUserFromUserAuth,
-		rateLimiter,
-		appMetrics.GetMeter(),
-		isValidChildAccount,
-	)
-
-	corsMiddleware := cors.AllowAll()
-
-	metricsMiddleware := appMetrics.HTTPMiddleware()
-
-	router.Use(metricsMiddleware.Handler, corsMiddleware.Handler, authMiddleware.Handler)
-
 	instanceManager, err := nbinstance.NewManager(ctx, accountManager.GetStore(), idpManager)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create instance manager: %w", err)
@@ -135,7 +113,7 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		reverseproxymanager.RegisterEndpoints(serviceManager, *reverseProxyDomainManager, reverseProxyAccessLogsManager, permissionsManager, router)
 	}
 
-	proxytoken.RegisterEndpoints(accountManager.GetStore(), permissionsManager, router)
+	proxytoken.RegisterEndpoints(accountManager.GetStore(), permissionsManager, proxyTokenRevocationGuard, router)
 
 	// Register OAuth callback handler for proxy authentication
 	if proxyGRPCServer != nil {

management/server/http/handlers/accounts/accounts_handler.go

@@ -128,7 +128,7 @@ func (h *handler) validateNetworkRange(ctx context.Context, accountID, userID st
 }
 
 func (h *handler) validateCapacity(ctx context.Context, accountID, userID string, prefix netip.Prefix) error {
-	peers, err := h.accountManager.GetPeers(ctx, accountID, userID, "", "")
+	peers, err := h.accountManager.GetPeers(ctx, accountID, userID, "", "", "")
 	if err != nil {
 		return status.Errorf(status.Internal, "get peer count: %v", err)
 	}

management/server/http/handlers/groups/groups_handler.go

@@ -58,7 +58,7 @@ func (h *handler) getAllGroups(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+		accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 		if err != nil {
 			util.WriteError(r.Context(), err, w)
 			return
@@ -77,7 +77,7 @@ func (h *handler) getAllGroups(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -169,7 +169,7 @@ func (h *handler) updateGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -226,7 +226,7 @@ func (h *handler) createGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -287,7 +287,7 @@ func (h *handler) getGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return

management/server/http/handlers/groups/groups_handler_test.go

@@ -78,7 +78,7 @@ func initGroupTestData(initGroups ...*types.Group) *handler {
 
 				return nil, status.Errorf(status.NotFound, "unknown group name")
 			},
-			GetPeersFunc: func(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+			GetPeersFunc: func(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 				return maps.Values(TestPeers), nil
 			},
 			DeleteGroupFunc: func(_ context.Context, accountID, userId, groupID string) error {

management/server/http/handlers/peers/peers_handler.go

@@ -317,10 +317,11 @@ func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 
 	nameFilter := r.URL.Query().Get("name")
 	ipFilter := r.URL.Query().Get("ip")
+	macFilter := r.URL.Query().Get("mac")
 
 	accountID, userID := userAuth.AccountId, userAuth.UserId
 
-	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter)
+	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -571,6 +572,17 @@ func peerToAccessiblePeer(peer *nbpeer.Peer, dnsDomain string) api.AccessiblePee
 	}
 }
 
+func toNetworkAddresses(addrs []nbpeer.NetworkAddress) *[]api.NetworkAddress {
+	if len(addrs) == 0 {
+		return nil
+	}
+	out := make([]api.NetworkAddress, 0, len(addrs))
+	for _, a := range addrs {
+		out = append(out, api.NetworkAddress{NetIp: a.NetIP.String(), Mac: a.Mac})
+	}
+	return &out
+}
+
 func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, approved bool, reason string) *api.Peer {
 	osVersion := peer.Meta.OSVersion
 	if osVersion == "" {
@@ -583,6 +595,7 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
 		Name:                        peer.Name,
 		Ip:                          peer.IP.String(),
 		Ipv6:                        peerIPv6String(peer),
+		NetworkAddresses:            toNetworkAddresses(peer.Meta.NetworkAddresses),
 		ConnectionIp:                peer.Location.ConnectionIP.String(),
 		Connected:                   peer.Status.Connected,
 		LastSeen:                    peer.Status.LastSeen,
@@ -639,6 +652,7 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
 		Name:                        peer.Name,
 		Ip:                          peer.IP.String(),
 		Ipv6:                        peerIPv6String(peer),
+		NetworkAddresses:            toNetworkAddresses(peer.Meta.NetworkAddresses),
 		ConnectionIp:                peer.Location.ConnectionIP.String(),
 		Connected:                   peer.Status.Connected,
 		LastSeen:                    peer.Status.LastSeen,

management/server/http/handlers/peers/peers_handler_test.go

@@ -173,7 +173,7 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 					return nil, fmt.Errorf("user not found")
 				}
 			},
-			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 				return peers, nil
 			},
 			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
@@ -364,6 +364,50 @@ func TestGetPeers(t *testing.T) {
 	}
 }
 
+func TestPeerResponseNetworkAddresses(t *testing.T) {
+	tests := []struct {
+		name      string
+		addresses []nbpeer.NetworkAddress
+		wantJSON  string
+	}{
+		{name: "not reported"},
+		{name: "empty", addresses: []nbpeer.NetworkAddress{}},
+		{
+			name: "multiple interfaces",
+			addresses: []nbpeer.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+				{NetIP: netip.MustParsePrefix("2001:db8::123/64"), Mac: "00:93:37:bd:83:10"},
+			},
+			wantJSON: `[{"net_ip":"192.168.0.11/24","mac":"00:93:37:bd:83:0f"},{"net_ip":"2001:db8::123/64","mac":"00:93:37:bd:83:10"}]`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peer := &nbpeer.Peer{
+				Status: &nbpeer.PeerStatus{},
+				Meta:   nbpeer.PeerSystemMeta{NetworkAddresses: tt.addresses},
+			}
+			responses := map[string]any{
+				"single peer": toSinglePeerResponse(peer, nil, "example.com", true, ""),
+				"peer list":   toPeerListItemResponse(peer, nil, "example.com", 0),
+			}
+			for name, response := range responses {
+				t.Run(name, func(t *testing.T) {
+					body, err := json.Marshal(response)
+					require.NoError(t, err)
+					var fields map[string]json.RawMessage
+					require.NoError(t, json.Unmarshal(body, &fields))
+					if tt.wantJSON == "" {
+						assert.NotContains(t, fields, "network_addresses", "unreported interfaces should be omitted")
+						return
+					}
+					assert.JSONEq(t, tt.wantJSON, string(fields["network_addresses"]), "response should preserve interface addresses and MACs")
+				})
+			}
+		})
+	}
+}
+
 func TestGetAccessiblePeers(t *testing.T) {
 	peer1 := &nbpeer.Peer{
 		ID:                     "peer1",

management/server/http/handlers/proxy/auth.go

@@ -16,21 +16,21 @@ import (
 	"golang.org/x/oauth2"
 
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // AuthCallbackHandler handles OAuth callbacks for proxy authentication.
 type AuthCallbackHandler struct {
 	proxyService   *nbgrpc.ProxyServiceServer
-	rateLimiter    *middleware.APIRateLimiter
+	rateLimiter    *ratelimit.APIRateLimiter
 	trustedProxies []netip.Prefix
 }
 
 // NewAuthCallbackHandler creates a new OAuth callback handler.
 func NewAuthCallbackHandler(proxyService *nbgrpc.ProxyServiceServer, trustedProxies []netip.Prefix) *AuthCallbackHandler {
-	rateLimiterConfig := &middleware.RateLimiterConfig{
+	rateLimiterConfig := &ratelimit.RateLimiterConfig{
 		RequestsPerMinute: 10,
 		Burst:             15,
 		CleanupInterval:   5 * time.Minute,
@@ -39,7 +39,7 @@ func NewAuthCallbackHandler(proxyService *nbgrpc.ProxyServiceServer, trustedProx
 
 	return &AuthCallbackHandler{
 		proxyService:   proxyService,
-		rateLimiter:    middleware.NewAPIRateLimiter(rateLimiterConfig),
+		rateLimiter:    ratelimit.NewAPIRateLimiter(rateLimiterConfig),
 		trustedProxies: trustedProxies,
 	}
 }
@@ -59,7 +59,7 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 
 	state := r.URL.Query().Get("state")
 
-	codeVerifier, originalURL, err := h.proxyService.ValidateState(state)
+	codeVerifier, originalURL, useSessionCode, err := h.proxyService.ValidateState(state)
 	if err != nil {
 		log.WithError(err).Error("OAuth callback state validation failed")
 		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
@@ -119,10 +119,19 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 	redirectURL.Scheme = "https"
 
 	query := redirectURL.Query()
-	query.Set("session_token", sessionToken)
+	if useSessionCode {
+		code, ok := h.proxyService.GenerateSessionCode(sessionToken)
+		if !ok {
+			http.Error(w, "Failed to create session", http.StatusInternalServerError)
+			return
+		}
+		query.Set(auth.SessionCodeQueryParam, code)
+	} else {
+		query.Set(auth.SessionTokenQueryParam, sessionToken)
+	}
 	redirectURL.RawQuery = query.Encode()
 
-	log.WithField("redirect", redirectURL.Host).Debug("OAuth callback: redirecting user with session token")
+	log.WithField("redirect", redirectURL.Host).Debug("OAuth callback: redirecting user to proxy")
 	http.Redirect(w, r, redirectURL.String(), http.StatusFound)
 }
 

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -181,6 +181,10 @@ func (m *testAccessLogManager) GetAllAccessLogs(_ context.Context, _, _ string,
 }
 
 func setupAuthCallbackTest(t *testing.T) *testSetup {
+	return setupAuthCallbackTestWithProxyManager(t, testSessionCodeManager{})
+}
+
+func setupAuthCallbackTestWithProxyManager(t *testing.T, proxyManager nbproxy.Manager) *testSetup {
 	t.Helper()
 
 	ctx := context.Background()
@@ -197,7 +201,7 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	require.NoError(t, err)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 
 	usersManager := users.NewManager(testStore)
 
@@ -212,12 +216,12 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	proxyService := nbgrpc.NewProxyServiceServer(
 		&testAccessLogManager{},
 		tokenStore,
-		pkceStore,
+		singleUseStore,
 		oidcConfig,
 		nil,
 		usersManager,
 		nil,
-		nil,
+		proxyManager,
 		nil,
 	)
 
@@ -242,6 +246,15 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	}
 }
 
+type testSessionCodeManager struct {
+	nbproxy.Manager
+	supported bool
+}
+
+func (m testSessionCodeManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
+	return m.supported
+}
+
 func createTestReverseProxies(t *testing.T, ctx context.Context, testStore store.Store) {
 	t.Helper()
 
@@ -252,10 +265,11 @@ func createTestReverseProxies(t *testing.T, ctx context.Context, testStore store
 	privKey := base64.StdEncoding.EncodeToString(priv)
 
 	testProxy := &service.Service{
-		ID:        "testProxyId",
-		AccountID: "testAccountId",
-		Name:      "Test Proxy",
-		Domain:    "test-proxy.example.com",
+		ID:           "testProxyId",
+		AccountID:    "testAccountId",
+		Name:         "Test Proxy",
+		Domain:       "test-proxy.example.com",
+		ProxyCluster: "cluster.example.com",
 		Targets: []*service.Target{{
 			Path:       strPtr("/"),
 			Host:       "localhost",
@@ -512,29 +526,56 @@ func createTestState(t *testing.T, ps *nbgrpc.ProxyServiceServer, redirectURL st
 }
 
 func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
-	setup := setupAuthCallbackTest(t)
-	defer setup.cleanup()
+	tests := []struct {
+		name        string
+		manager     nbproxy.Manager
+		wantParam   string
+		absentParam string
+	}{
+		{name: "legacy proxy", manager: testSessionCodeManager{}, wantParam: "session_token", absentParam: "nb_session_code"},
+		{name: "compatible proxy", manager: testSessionCodeManager{supported: true}, wantParam: "nb_session_code", absentParam: "session_token"},
+	}
 
-	setup.oidcServer.tokenSubject = "allowedUserId"
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupAuthCallbackTestWithProxyManager(t, tt.manager)
+			defer setup.cleanup()
 
-	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+			setup.oidcServer.tokenSubject = "allowedUserId"
+			state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+			req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+			rec := httptest.NewRecorder()
+			setup.router.ServeHTTP(rec, req)
+			require.Equal(t, http.StatusFound, rec.Code)
 
-	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
-	rec := httptest.NewRecorder()
+			location, err := url.Parse(rec.Header().Get("Location"))
+			require.NoError(t, err)
+			require.Equal(t, "test-proxy.example.com", location.Host)
+			require.NotEmpty(t, location.Query().Get(tt.wantParam))
+			require.Empty(t, location.Query().Get(tt.absentParam))
+			require.Empty(t, location.Query().Get("error"))
 
-	setup.router.ServeHTTP(rec, req)
+			if tt.wantParam == "nb_session_code" {
+				code := location.Query().Get("nb_session_code")
+				response, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+					Domain:      location.Hostname(),
+					SessionCode: code,
+				})
+				require.NoError(t, err)
+				require.True(t, response.GetValid())
+				require.NotEmpty(t, response.GetSessionToken())
+				require.NotEqual(t, code, response.GetSessionToken())
 
-	require.Equal(t, http.StatusFound, rec.Code)
-
-	location := rec.Header().Get("Location")
-	require.NotEmpty(t, location)
-
-	parsedLocation, err := url.Parse(location)
-	require.NoError(t, err)
-
-	require.Equal(t, "test-proxy.example.com", parsedLocation.Host)
-	require.NotEmpty(t, parsedLocation.Query().Get("session_token"), "Should include session token")
-	require.Empty(t, parsedLocation.Query().Get("error"), "Should not have error parameter")
+				replayed, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+					Domain:      location.Hostname(),
+					SessionCode: code,
+				})
+				require.NoError(t, err)
+				require.False(t, replayed.GetValid())
+				require.Empty(t, replayed.GetSessionToken())
+			}
+		})
+	}
 }
 
 // TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account

management/server/http/handlers/users/invites_handler.go

@@ -11,15 +11,15 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // publicInviteRateLimiter limits public invite requests by IP address to prevent brute-force attacks
-var publicInviteRateLimiter = middleware.NewAPIRateLimiter(&middleware.RateLimiterConfig{
+var publicInviteRateLimiter = ratelimit.NewAPIRateLimiter(&ratelimit.RateLimiterConfig{
 	RequestsPerMinute: 10, // 10 attempts per minute per IP
 	Burst:             5,  // Allow burst of 5 requests
 	CleanupInterval:   10 * time.Minute,

management/server/http/middleware/auth_middleware.go

@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 type EnsureAccountFunc func(ctx context.Context, userAuth auth.UserAuth) (string, string, error)
@@ -33,7 +34,7 @@ type AuthMiddleware struct {
 	ensureAccount       EnsureAccountFunc
 	getUserFromUserAuth GetUserFromUserAuthFunc
 	syncUserJWTGroups   SyncUserJWTGroupsFunc
-	rateLimiter         *APIRateLimiter
+	rateLimiter         *ratelimit.APIRateLimiter
 	patUsageTracker     *PATUsageTracker
 	isValidChildAccount IsValidChildAccountFunc
 }
@@ -44,7 +45,7 @@ func NewAuthMiddleware(
 	ensureAccount EnsureAccountFunc,
 	syncUserJWTGroups SyncUserJWTGroupsFunc,
 	getUserFromUserAuth GetUserFromUserAuthFunc,
-	rateLimiter *APIRateLimiter,
+	rateLimiter *ratelimit.APIRateLimiter,
 	meter metric.Meter,
 	isValidChildAccount IsValidChildAccountFunc,
 ) *AuthMiddleware {