Merge remote-tracking branch 'origin/main' into fix_debug_upload_url_from_mgmt

# Conflicts:
#	client/proto/daemon.pb.go
#	management/internals/controllers/network_map/controller/controller.go
#	management/internals/controllers/network_map/nmaptest/runner.go
#	management/internals/shared/grpc/server.go
#	management/server/account.go
#	shared/management/proto/management.pb.go
#	upload-server/server/server.go

management/server/account.go

@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -84,7 +83,6 @@ type DefaultAccountManager struct {
 
 	requestBuffer *AccountRequestBuffer
 
-	proxyController port_forwarding.Controller
 	settingsManager settings.Manager
 	serviceManager  service.Manager
 
@@ -112,6 +110,9 @@ type DefaultAccountManager struct {
 	permissionsManager permissions.Manager
 
 	disableDefaultPolicy bool
+
+	deletionHooksMu sync.RWMutex
+	deletionHooks   []account.DeletionHook
 }
 
 var _ account.Manager = (*DefaultAccountManager)(nil)
@@ -120,6 +121,32 @@ func (am *DefaultAccountManager) SetServiceManager(serviceManager service.Manage
 	am.serviceManager = serviceManager
 }
 
+// AddAccountDeletionHook registers hook to run on every account deletion. Hooks run in
+// registration order, and the first one to fail stops the rest and aborts the deletion.
+// It panics on a nil hook: dropping one silently would skip that hook's cleanup on every
+// deletion, so the wiring bug surfaces at startup instead.
+func (am *DefaultAccountManager) AddAccountDeletionHook(hook account.DeletionHook) {
+	if hook == nil {
+		panic("nil account deletion hook")
+	}
+	am.deletionHooksMu.Lock()
+	defer am.deletionHooksMu.Unlock()
+	am.deletionHooks = append(am.deletionHooks, hook)
+}
+
+func (am *DefaultAccountManager) runAccountDeletionHooks(ctx context.Context, accountID string) error {
+	am.deletionHooksMu.RLock()
+	hooks := slices.Clone(am.deletionHooks)
+	am.deletionHooksMu.RUnlock()
+
+	for _, hook := range hooks {
+		if err := hook(ctx, accountID); err != nil {
+			return fmt.Errorf("account deletion hook: %w", err)
+		}
+	}
+	return nil
+}
+
 func isUniqueConstraintError(err error) bool {
 	switch {
 	case strings.Contains(err.Error(), "(SQLSTATE 23505)"),
@@ -196,7 +223,6 @@ func BuildManager(
 	userDeleteFromIDPEnabled bool,
 	integratedPeerValidator integrated_validator.IntegratedValidator,
 	metrics telemetry.AppMetrics,
-	proxyController port_forwarding.Controller,
 	settingsManager settings.Manager,
 	permissionsManager permissions.Manager,
 	disableDefaultPolicy bool,
@@ -224,7 +250,6 @@ func BuildManager(
 		integratedPeerValidator:  integratedPeerValidator,
 		metrics:                  metrics,
 		requestBuffer:            NewAccountRequestBuffer(ctx, store),
-		proxyController:          proxyController,
 		settingsManager:          settingsManager,
 		permissionsManager:       permissionsManager,
 		disableDefaultPolicy:     disableDefaultPolicy,
@@ -305,6 +330,9 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	var groupChangesAffectPeers bool
 	var reloadReverseProxy bool
 	var effectiveOldNetworkRange netip.Prefix
+	var ipv6Changed bool
+	var ipv6Snap *affectedpeers.Snapshot
+	var ipv6Change affectedpeers.Change
 
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		var groupsUpdated bool
@@ -350,10 +378,10 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 
 		if ipv6SettingsChanged(oldSettings, newSettings) {
-			if err = am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings); err != nil {
+			if ipv6Change, err = am.applyIPv6SettingsChange(ctx, transaction, accountID, oldSettings, newSettings); err != nil {
 				return err
 			}
-			updateAccountPeers = true
+			ipv6Changed = true
 		}
 
 		if oldSettings.RoutingPeerDNSResolutionEnabled != newSettings.RoutingPeerDNSResolutionEnabled ||
@@ -391,12 +419,20 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 			return err
 		}
 
-		if updateAccountPeers || groupsUpdated {
+		if updateAccountPeers || groupsUpdated || ipv6Changed {
 			if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 				return err
 			}
 		}
 
+		// A full account refresh already covers the IPv6 change, so the affected-peers
+		// snapshot is only needed when nothing account-wide changed.
+		if ipv6Changed && !updateAccountPeers && !groupChangesAffectPeers {
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return fmt.Errorf("load affected peers: %w", err)
+			}
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -459,13 +495,34 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 		}
 	}
 
-	if updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers {
+	switch {
+	case updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers:
 		go am.UpdateAccountPeers(context.WithoutCancel(ctx), accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
+	case ipv6Snap != nil:
+		am.ExpandAndUpdateAffected(ctx, accountID, ipv6Snap, ipv6Change)
 	}
 
 	return newSettings, nil
 }
 
+// applyIPv6SettingsChange reconciles peer IPv6 addresses for new IPv6 settings and
+// returns the affected-peers change: peers whose address changed refresh together
+// with every peer that reaches them. On a range change every peer holding an address
+// also refreshes itself, since its interface prefix comes from the account range even
+// when its address stays inside the new one.
+func (am *DefaultAccountManager) applyIPv6SettingsChange(ctx context.Context, transaction store.Store, accountID string, oldSettings, newSettings *types.Settings) (affectedpeers.Change, error) {
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings)
+	if err != nil {
+		return affectedpeers.Change{}, err
+	}
+
+	change := affectedpeers.Change{ChangedPeerIDs: result.changed}
+	if oldSettings.NetworkRangeV6 != newSettings.NetworkRangeV6 {
+		change.OutputPeerIDs = result.withIPv6
+	}
+	return change, nil
+}
+
 func ipv6SettingsChanged(old, updated *types.Settings) bool {
 	if old.NetworkRangeV6 != updated.NetworkRangeV6 {
 		return true
@@ -902,6 +959,10 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
 		return status.Errorf(status.Internal, "failed to build user infos for account %s: %v", accountID, err)
 	}
 
+	if err = am.runAccountDeletionHooks(ctx, accountID); err != nil {
+		return err
+	}
+
 	if err = am.deleteAccountUsers(ctx, accountID, userID, account.Users, userInfosMap); err != nil {
 		return err
 	}
@@ -1722,9 +1783,11 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 
 			change.LinkGroups = allGroupChanges
 
-			if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges); err != nil {
+			ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges)
+			if err != nil {
 				return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 			}
+			change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
 
 			if err = transaction.IncrementNetworkSerial(ctx, userAuth.AccountId); err != nil {
 				return fmt.Errorf("error incrementing network serial: %w", err)
@@ -2314,7 +2377,8 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, err
 	}
 
-	if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups); err != nil {
+	ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups)
+	if err != nil {
 		return false, false, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 	}
 
@@ -2323,7 +2387,7 @@ func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Conte
 		return false, false, fmt.Errorf("error checking if group changes affect peers: %w", err)
 	}
 
-	return len(updatedGroups) > 0, peersAffected, nil
+	return len(updatedGroups) > 0, peersAffected || len(ipv6Changed) > 0, nil
 }
 
 // propagateAutoGroupsForUsers adds each user's peers to their AutoGroups where not already present.
@@ -2371,7 +2435,7 @@ func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, t
 		return err
 	}
 
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
 		return err
 	}
@@ -2408,7 +2472,7 @@ func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, t
 // v6 address get one allocated. When disabled, all v6 addresses are cleared.
 // When the v6 range changes, all v6 addresses are reallocated.
 func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transaction store.Store, accountID, peerID string, newIPv6 netip.Addr) error {
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
 	if err != nil {
 		return fmt.Errorf("get peers: %w", err)
 	}
@@ -2420,56 +2484,78 @@ func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transac
 	return nil
 }
 
-func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) error {
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "")
+// ipv6Reassignment reports the outcome of an IPv6 address reconciliation.
+type ipv6Reassignment struct {
+	// changed are the peers whose IPv6 address was assigned, removed or reallocated.
+	changed []string
+	// withIPv6 are all peers holding an IPv6 address after the reconciliation.
+	withIPv6 []string
+}
+
+func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) (ipv6Reassignment, error) {
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
 	if err != nil {
-		return fmt.Errorf("get peers: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get peers: %w", err)
 	}
 
 	network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthUpdate, accountID)
 	if err != nil {
-		return fmt.Errorf("get network: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("get network: %w", err)
 	}
 
 	if err := am.ensureIPv6Subnet(ctx, transaction, accountID, settings, network); err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	allowedPeers, err := am.buildIPv6AllowedPeers(ctx, transaction, accountID, settings)
 	if err != nil {
-		return err
+		return ipv6Reassignment{}, err
 	}
 
 	v6Prefix, err := netip.ParsePrefix(network.NetV6.String())
 	if err != nil {
-		return fmt.Errorf("parse IPv6 prefix: %w", err)
+		return ipv6Reassignment{}, fmt.Errorf("parse IPv6 prefix: %w", err)
 	}
 
-	if err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix); err != nil {
-		return err
+	changed, err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix)
+	if err != nil {
+		return ipv6Reassignment{}, err
 	}
 
-	log.WithContext(ctx).Infof("updated IPv6 addresses for %d peers in account %s (groups=%d)",
-		len(peers), accountID, len(settings.IPv6EnabledGroups))
+	result := ipv6Reassignment{changed: changed}
+	for _, peer := range peers {
+		if peer.IPv6.IsValid() {
+			result.withIPv6 = append(result.withIPv6, peer.ID)
+		}
+	}
 
-	return nil
+	log.WithContext(ctx).Infof("updated IPv6 addresses for %d of %d peers in account %s (groups=%d)",
+		len(changed), len(peers), accountID, len(settings.IPv6EnabledGroups))
+
+	return result, nil
 }
 
 // reconcileIPv6ForGroupChanges checks whether the given group IDs overlap with
 // the account's IPv6EnabledGroups. If they do, it runs a full IPv6 address
 // reconciliation so that peers gaining or losing membership in an IPv6-enabled
-// group get their addresses assigned or removed.
-func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) error {
+// group get their addresses assigned or removed. It returns the peers whose IPv6
+// address changed, which callers pass as changed peers so every peer that can
+// reach them refreshes.
+func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) ([]string, error) {
 	settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
-		return fmt.Errorf("get account settings: %w", err)
+		return nil, fmt.Errorf("get account settings: %w", err)
 	}
 
 	if !ipv6ReconcileNeeded(settings, groupIDs) {
-		return nil
+		return nil, nil
 	}
 
-	return am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
+	if err != nil {
+		return nil, err
+	}
+	return result.changed, nil
 }
 
 // ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
@@ -2508,7 +2594,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 	ctx context.Context, transaction store.Store, accountID string,
 	peers []*nbpeer.Peer, network *types.Network,
 	allowedPeers map[string]struct{}, v6Prefix netip.Prefix,
-) error {
+) ([]string, error) {
 	takenV6 := make(map[netip.Addr]struct{})
 	for _, peer := range peers {
 		if _, ok := allowedPeers[peer.ID]; ok && peer.IPv6.IsValid() && network.NetV6.Contains(peer.IPv6.AsSlice()) {
@@ -2516,6 +2602,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 	}
 
+	var changed []string
 	for _, peer := range peers {
 		_, allowed := allowedPeers[peer.ID]
 		oldIPv6 := peer.IPv6
@@ -2525,7 +2612,7 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		} else if !peer.IPv6.IsValid() || !network.NetV6.Contains(peer.IPv6.AsSlice()) {
 			newIP, err := allocateIPv6WithRetry(v6Prefix, takenV6, peer.ID)
 			if err != nil {
-				return err
+				return nil, err
 			}
 			peer.IPv6 = newIP
 		}
@@ -2535,10 +2622,11 @@ func (am *DefaultAccountManager) assignPeerIPv6Addresses(
 		}
 
 		if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
-			return fmt.Errorf("save peer %s: %w", peer.ID, err)
+			return nil, fmt.Errorf("save peer %s: %w", peer.ID, err)
 		}
+		changed = append(changed, peer.ID)
 	}
-	return nil
+	return changed, nil
 }
 
 func allocateIPv6WithRetry(prefix netip.Prefix, taken map[netip.Addr]struct{}, peerID string) (netip.Addr, error) {
@@ -2582,7 +2670,7 @@ func (am *DefaultAccountManager) buildIPv6AllowedPeers(ctx context.Context, tran
 
 	// Embedded proxy peers sit outside regular group membership but must
 	// participate in any v6-enabled overlay to reach v6-only peers.
-	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	if err != nil {
 		return nil, fmt.Errorf("get peers: %w", err)
 	}
@@ -2653,7 +2741,7 @@ func (am *DefaultAccountManager) updatePeerIPInTransaction(ctx context.Context,
 			return nil
 		}
 
-		peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "")
+		peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
 		if err != nil {
 			return fmt.Errorf("get account peers: %w", err)
 		}

management/server/account/deletion_hook.go

@@ -0,0 +1,14 @@
+package account
+
+import "context"
+
+// DeletionHook runs when an account is deleted, after the caller's permission to delete
+// it has been checked and before any of its users or data are removed. It lets code that
+// keeps per-account state outside the store tear that state down while the account still
+// exists.
+//
+// A hook that returns an error aborts the deletion and the account is kept. The caller
+// sees the error, so a hook that wants a specific response returns a status error. A
+// retried deletion runs every hook again, and a later step can still fail after the hooks
+// succeed, so a hook must be idempotent and must tolerate the account surviving it.
+type DeletionHook func(ctx context.Context, accountID string) error

management/server/account/manager.go

@@ -62,7 +62,7 @@ type Manager interface {
 	GetUserByID(ctx context.Context, id string) (*types.User, error)
 	GetUserFromUserAuth(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 	ListUsers(ctx context.Context, accountID string) ([]*types.User, error)
-	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
 	MarkPeerConnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error
 	MarkPeerDisconnected(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error
 	DeletePeer(ctx context.Context, accountID, peerID, userID string) error

management/server/account/manager_mock.go

@@ -982,18 +982,18 @@ func (mr *MockManagerMockRecorder) GetPeerNetwork(ctx, peerID any) *gomock.Call
 }
 
 // GetPeers mocks base method.
-func (m *MockManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*peer.Peer, error) {
+func (m *MockManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*peer.Peer, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetPeers", ctx, accountID, userID, nameFilter, ipFilter)
+	ret := m.ctrl.Call(m, "GetPeers", ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 	ret0, _ := ret[0].([]*peer.Peer)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetPeers indicates an expected call of GetPeers.
-func (mr *MockManagerMockRecorder) GetPeers(ctx, accountID, userID, nameFilter, ipFilter any) *gomock.Call {
+func (mr *MockManagerMockRecorder) GetPeers(ctx, accountID, userID, nameFilter, ipFilter, macFilter any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeers", reflect.TypeOf((*MockManager)(nil).GetPeers), ctx, accountID, userID, nameFilter, ipFilter)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPeers", reflect.TypeOf((*MockManager)(nil).GetPeers), ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 }
 
 // GetPolicy mocks base method.

management/server/account_test.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus/push"
@@ -40,6 +41,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db"
 	networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory"
+	networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbAccount "github.com/netbirdio/netbird/management/server/account"
@@ -47,7 +49,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -958,6 +959,101 @@ func TestAccountManager_DeleteAccount(t *testing.T) {
 	assert.Len(t, pats, 0)
 }
 
+func TestAccountManager_DeleteAccount_RunsDeletionHooks(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	// Each hook records its call and checks the account is still in the store, which is
+	// the point of running before deletion: a hook must be able to read what it cleans up.
+	var calls []string
+	hook := func(name string) nbAccount.DeletionHook {
+		return func(ctx context.Context, accountID string) error {
+			calls = append(calls, name+":"+accountID)
+			_, err := manager.Store.GetAccount(ctx, accountID)
+			assert.NoError(t, err, "account should still exist while hook %s runs", name)
+			return nil
+		}
+	}
+	manager.AddAccountDeletionHook(hook("first"))
+	manager.AddAccountDeletionHook(hook("second"))
+
+	require.NoError(t, manager.DeleteAccount(context.Background(), account.Id, ownerID))
+
+	assert.Equal(t, []string{"first:" + account.Id, "second:" + account.Id}, calls,
+		"hooks should run once each, in registration order, with the deleted account's ID")
+	_, err = manager.Store.GetAccount(context.Background(), account.Id)
+	assert.Error(t, err, "account should be deleted after the hooks succeed")
+}
+
+func TestAccountManager_DeleteAccount_DeletionHookErrorAbortsDeletion(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		return status.Errorf(status.PreconditionFailed, "teardown refused")
+	})
+	secondCalled := false
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		secondCalled = true
+		return nil
+	})
+
+	err = manager.DeleteAccount(context.Background(), account.Id, ownerID)
+	require.Error(t, err)
+
+	// The hook's status type has to survive the wrapping, since the HTTP layer maps it
+	// to the response code.
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "error should carry the hook's status error, got %v", err)
+	assert.Equal(t, status.PreconditionFailed, sErr.Type(), "status type should be the hook's")
+	assert.False(t, secondCalled, "hooks after a failing one should not run")
+
+	_, err = manager.Store.GetAccount(context.Background(), account.Id)
+	assert.NoError(t, err, "account should survive a failing hook")
+	_, err = manager.Store.GetUserByUserID(context.Background(), store.LockingStrengthNone, ownerID)
+	assert.NoError(t, err, "account owner should survive a failing hook")
+}
+
+func TestAccountManager_AddAccountDeletionHook_RejectsNil(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	assert.PanicsWithValue(t, "nil account deletion hook", func() {
+		manager.AddAccountDeletionHook(nil)
+	}, "registering a nil hook should panic instead of breaking a later deletion")
+}
+
+func TestAccountManager_DeleteAccount_DeletionHooksSkippedWithoutPermission(t *testing.T) {
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+
+	ownerID := "account_creator"
+	account, err := createAccount(manager, "test_account", ownerID, "")
+	require.NoError(t, err)
+
+	adminID := "regular_admin"
+	account.Users[adminID] = types.NewAdminUser(adminID)
+	require.NoError(t, manager.Store.SaveAccount(context.Background(), account))
+
+	called := false
+	manager.AddAccountDeletionHook(func(context.Context, string) error {
+		called = true
+		return nil
+	})
+
+	err = manager.DeleteAccount(context.Background(), account.Id, adminID)
+	require.Error(t, err, "only the owner may delete the account")
+	assert.False(t, called, "hooks should not run for a caller who may not delete the account")
+}
+
 func BenchmarkTest_GetAccountWithclaims(b *testing.B) {
 	claims := auth.UserAuth{
 		Domain:         "example.com",
@@ -1202,7 +1298,9 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_SaveGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SaveGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
@@ -1235,6 +1333,8 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1257,7 +1357,9 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
@@ -1266,13 +1368,7 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
-	// Ensure that we do not receive an update message before the policy is deleted
-	time.Sleep(time.Second)
-	select {
-	case <-updMsg:
-		t.Logf("received addPeer update message before policy deletion")
-	default:
-	}
+	settleAffectedUpdates(updMsg)
 
 	wg := sync.WaitGroup{}
 	wg.Add(1)
@@ -1295,7 +1391,9 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
-	testAccountManager_NetworkUpdates_SavePolicy(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_SavePolicy(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
@@ -1315,6 +1413,8 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1348,7 +1448,9 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeletePeer(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeletePeer(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
@@ -1387,6 +1489,8 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 	defer updateManager.CloseChannel(context.Background(), peer1.ID)
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -1408,7 +1512,9 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
 }
 
 func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
-	testAccountManager_NetworkUpdates_DeleteGroup(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		testAccountManager_NetworkUpdates_DeleteGroup(t)
+	})
 }
 
 func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
@@ -1455,6 +1561,8 @@ func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
 		}
 	}
 
+	settleAffectedUpdates(updMsg)
+
 	wg := sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -2462,7 +2570,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_PeerApproval(t *testing.T)
 	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, newSettings)
 	require.NoError(t, err)
 
-	accountPeers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	accountPeers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 
 	for _, peer := range accountPeers {
@@ -3487,6 +3595,9 @@ func createManagerWithNetworkMapStore(t testing.TB) (*DefaultAccountManager, *up
 
 	nmdataStore, err := networkmapdbfactory.NewNetworkMapDBStore(context.Background(), types.SqliteStoreEngine, dataDir, MockIntegratedValidator{}, newSettingsMockManager(t))
 	require.NoError(t, err)
+	sqliteStore, ok := nmdataStore.Store.(*networkmap_sqlite.SqliteStore)
+	require.True(t, ok, "network map store is %T, want *networkmap_sqlite.SqliteStore", nmdataStore.Store)
+	t.Cleanup(func() { assert.NoError(t, sqliteStore.Db.Close()) })
 
 	manager, updateManager, err := buildTestManager(t, store, nmdataStore)
 	require.NoError(t, err)
@@ -3541,20 +3652,24 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb
 		Return(nil).
 		AnyTimes()
 
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// The go-cache janitor only stops via a GC finalizer and would outlive synctest bubbles.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
-	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nmdataStore)
+	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := manager.cacheManager
+	t.Cleanup(func() { assert.NoError(t, cacheManager.Close()) })
 
 	proxyGrpcServer := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, peersManager, nil, nil, proxyManager, nil)
+	t.Cleanup(proxyGrpcServer.Close)
 	proxyController, err := proxymanager.NewGRPCController(proxyGrpcServer, noop.Meter{})
 	if err != nil {
 		return nil, nil, err
@@ -3648,6 +3763,33 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *update_channel.
 // when the channel delivers.
 const peerUpdateTimeout = 5 * time.Second
 
+// peerUpdateSettleTime bounds how far settleAffectedUpdates advances the fake clock. It must exceed
+// the account request and peer update buffer intervals.
+const peerUpdateSettleTime = time.Second
+
+// runPeerUpdateTest runs f inside synctest.Test, so the peer update helpers observe every background
+// goroutine of the test, and lets the updates still in flight when f returns finish before the bubble
+// ends, since the bubble's clock stops with it.
+func runPeerUpdateTest(t *testing.T, f func(t *testing.T)) {
+	synctest.Test(t, func(t *testing.T) {
+		defer settleAffectedUpdates()
+		f(t)
+	})
+}
+
+// settleAffectedUpdates runs the synctest bubble's fake clock past every update buffer interval until
+// all goroutines are blocked, then discards the updates already delivered to chans, so the next
+// assertion only observes updates from the action under test. It must be called inside synctest.Test.
+func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
+	time.Sleep(peerUpdateSettleTime)
+	synctest.Wait()
+	for _, ch := range chans {
+		for len(ch) > 0 {
+			<-ch
+		}
+	}
+}
+
 func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	for {
 		select {
@@ -3661,6 +3803,19 @@ func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) {
 	}
 }
 
+// step runs f as one named stage of a test inside synctest.Test, which forbids t.Run, and names the
+// stage when it fails the test. Stages share t, so a fatal failure ends the remaining stages as well.
+func step(t *testing.T, name string, f func(t *testing.T)) {
+	t.Helper()
+	failedBefore := t.Failed()
+	defer func() {
+		if !failedBefore && t.Failed() {
+			t.Logf("step %q failed", name)
+		}
+	}()
+	f(t)
+}
+
 func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *network_map.UpdateMessage) {
 	t.Helper()
 	select {
@@ -4462,7 +4617,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	require.Len(t, peers, len(before))
 	for _, p := range peers {
@@ -4480,7 +4635,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.Equal(t, before[p.ID], p.IP, "peer %s IP should not change for host-bit-set equivalent range", p.ID)
@@ -4494,7 +4649,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.Equal(t, before[p.ID], p.IP, "peer %s IP should not change when NetworkRange omitted", p.ID)
@@ -4510,7 +4665,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_NetworkRangePreserved(t *te
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, account.Id, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.True(t, newRange.Contains(p.IP), "peer %s should be in new range %s, got %s", p.ID, newRange, p.IP)
@@ -4528,7 +4683,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	require.NoError(t, err)
 	require.NotEmpty(t, settings.IPv6EnabledGroups, "new account should have IPv6 enabled for All group")
 
-	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err := manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.True(t, p.IPv6.IsValid(), "peer %s should have IPv6 with All group enabled", p.ID)
@@ -4556,7 +4711,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	assert.Equal(t, []string{partialGroup.ID}, updatedSettings.IPv6EnabledGroups)
 
 	// peer1 and peer2 should have IPv6; peer3 should not.
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	peerMap := make(map[string]*nbpeer.Peer, len(peers))
 	for _, p := range peers {
@@ -4576,7 +4731,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	require.NoError(t, err)
 	assert.Empty(t, updatedSettings.IPv6EnabledGroups)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	for _, p := range peers {
 		assert.False(t, p.IPv6.IsValid(), "peer %s should have no IPv6 when groups cleared", p.ID)
@@ -4591,7 +4746,7 @@ func TestDefaultAccountManager_UpdateAccountSettings_IPv6EnabledGroups(t *testin
 	})
 	require.NoError(t, err)
 
-	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = manager.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	require.NoError(t, err)
 	peerMap = make(map[string]*nbpeer.Peer, len(peers))
 	for _, p := range peers {

management/server/affected_peers_ipv6_test.go

@@ -0,0 +1,243 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const (
+	ipv6GroupA = "ipv6-grp-a"
+	ipv6GroupB = "ipv6-grp-b"
+	ipv6GroupC = "ipv6-grp-c"
+	ipv6GroupD = "ipv6-grp-d"
+)
+
+// ipv6AffectedTest holds three peers: peer1 in group A, peer2 in group B, peer3 in
+// group C, with a single A<->B policy. peer3 is unrelated to peer1 and peer2. Group D
+// is empty and referenced by nothing.
+type ipv6AffectedTest struct {
+	manager                   *DefaultAccountManager
+	accountID                 string
+	peer1, peer2, peer3       *nbpeer.Peer
+	updMsg1, updMsg2, updMsg3 <-chan *network_map.UpdateMessage
+}
+
+func setupIPv6AffectedTest(t *testing.T, ipv6Groups []string) *ipv6AffectedTest {
+	t.Helper()
+
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	for _, g := range []*types.Group{
+		{ID: ipv6GroupA, Name: "IPv6-A", Peers: []string{peer1.ID}},
+		{ID: ipv6GroupB, Name: "IPv6-B", Peers: []string{peer2.ID}},
+		{ID: ipv6GroupC, Name: "IPv6-C", Peers: []string{peer3.ID}},
+		{ID: ipv6GroupD, Name: "IPv6-D"},
+	} {
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, g))
+	}
+
+	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		Enabled: true,
+		Rules: []*types.PolicyRule{{
+			Enabled:       true,
+			Sources:       []string{ipv6GroupA},
+			Destinations:  []string{ipv6GroupB},
+			Bidirectional: true,
+			Action:        types.PolicyTrafficActionAccept,
+		}},
+	}, true)
+	require.NoError(t, err)
+
+	// New accounts enable IPv6 for the All group; start from the requested groups.
+	updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = ipv6Groups
+	})
+
+	tc := &ipv6AffectedTest{
+		manager:   manager,
+		accountID: accountID,
+		peer1:     peer1,
+		peer2:     peer2,
+		peer3:     peer3,
+	}
+	tc.updMsg1 = updateManager.CreateChannel(ctx, peer1.ID)
+	tc.updMsg2 = updateManager.CreateChannel(ctx, peer2.ID)
+	tc.updMsg3 = updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	// The setup changes above dispatch asynchronously and can land after the
+	// channels open, so drop them before the test acts.
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	return tc
+}
+
+// updateIPv6TestSettings applies mutate to a copy of the current settings, so only
+// the mutated fields differ from what is stored.
+func updateIPv6TestSettings(t *testing.T, manager *DefaultAccountManager, accountID string, mutate func(*types.Settings)) {
+	t.Helper()
+	ctx := context.Background()
+
+	current, err := manager.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+
+	updated := current.Copy()
+	mutate(updated)
+
+	_, err = manager.UpdateAccountSettings(ctx, accountID, userID, updated)
+	require.NoError(t, err)
+}
+
+func (tc *ipv6AffectedTest) peerIPv6(t *testing.T, peerID string) netip.Addr {
+	t.Helper()
+	peer, err := tc.manager.Store.GetPeerByID(context.Background(), store.LockingStrengthNone, tc.accountID, peerID)
+	require.NoError(t, err)
+	return peer.IPv6
+}
+
+func TestAffectedPeers_IPv6GroupEnabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+	})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6GroupDisabled_RefreshesOnlyReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should start with an IPv6 address")
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{}
+	})
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Widening the IPv6 range keeps peer addresses, but each holder's interface prefix
+// comes from the range, so holders refresh while peers that only reach them do not.
+func TestAffectedPeers_IPv6RangeWidened_RefreshesAddressHolders(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupA})
+	oldIPv6 := tc.peerIPv6(t, tc.peer1.ID)
+	require.True(t, oldIPv6.IsValid(), "peer1 should start with an IPv6 address")
+
+	// The range is allocated on the account network; settings may leave it empty.
+	network, err := tc.manager.Store.GetAccountNetwork(context.Background(), store.LockingStrengthNone, tc.accountID)
+	require.NoError(t, err)
+	current := prefixFromIPNet(network.NetV6)
+	require.True(t, current.IsValid(), "account should have an IPv6 range")
+	widened := netip.PrefixFrom(current.Addr(), current.Bits()-8).Masked()
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRangeV6 = widened
+	})
+	require.Equal(t, oldIPv6, tc.peerIPv6(t, tc.peer1.ID), "peer1 should keep its address inside the widened range")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldNotReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv4RangeChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.NetworkRange = netip.MustParsePrefix("100.70.0.0/16")
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_IPv6WithAccountWideChange_RefreshesWholeAccount(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, nil)
+
+	updateIPv6TestSettings(t, tc.manager, tc.accountID, func(s *types.Settings) {
+		s.IPv6EnabledGroups = []string{ipv6GroupA}
+		s.LazyConnectionEnabled = !s.LazyConnectionEnabled
+	})
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldReceiveUpdate(t, tc.updMsg3)
+}
+
+// Joining an IPv6-enabled group that no policy references gives peer1 an address.
+// peer2 reaches peer1 through group A, not through the joined group, and must still
+// learn the new address.
+func TestAffectedPeers_GroupAddPeerIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.GroupAddPeer(context.Background(), tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+func TestAffectedPeers_UpdateGroupIPv6_RefreshesPeersReachingThroughOtherGroups(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+
+	require.NoError(t, tc.manager.UpdateGroup(context.Background(), tc.accountID, userID, &types.Group{
+		ID:    ipv6GroupD,
+		Name:  "IPv6-D",
+		Peers: []string{tc.peer1.ID},
+	}))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}
+
+// Deleting an IPv6-enabled group removes its members' addresses after the
+// pre-delete snapshot was taken.
+func TestAffectedPeers_DeleteIPv6Group_RefreshesFormerMembersAndReachablePeers(t *testing.T) {
+	tc := setupIPv6AffectedTest(t, []string{ipv6GroupD})
+	ctx := context.Background()
+
+	require.NoError(t, tc.manager.GroupAddPeer(ctx, tc.accountID, ipv6GroupD, tc.peer1.ID))
+	require.True(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should get an IPv6 address")
+	drainPeerUpdates(tc.updMsg1)
+	drainPeerUpdates(tc.updMsg2)
+	drainPeerUpdates(tc.updMsg3)
+
+	require.NoError(t, tc.manager.DeleteGroup(ctx, tc.accountID, userID, ipv6GroupD))
+	require.False(t, tc.peerIPv6(t, tc.peer1.ID).IsValid(), "peer1 should lose its IPv6 address")
+
+	peerShouldReceiveUpdate(t, tc.updMsg1)
+	peerShouldReceiveUpdate(t, tc.updMsg2)
+	peerShouldNotReceiveUpdate(t, tc.updMsg3)
+}

management/server/affected_peers_jwt_test.go

@@ -87,93 +87,93 @@ func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T)
 // auto-group change updates only the user's peers and the peers linked to the changed
 // group through policies, instead of fanning out to the whole account.
 func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
-	}, false)
-	require.NoError(t, err)
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
+		}, false)
+		require.NoError(t, err)
 
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.JWTGroupsEnabled = true
-	account.Settings.JWTGroupsClaimName = "groups"
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+		account, err = manager.Store.GetAccount(ctx, accountID)
+		require.NoError(t, err)
+		account.Settings.JWTGroupsEnabled = true
+		account.Settings.JWTGroupsClaimName = "groups"
+		account.Settings.GroupsPropagationEnabled = true
+		require.NoError(t, manager.Store.SaveAccount(ctx, account))
 
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
 
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"jwt-grp"},
-				Destinations:  []string{"jwt-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"jwt-grp"},
+					Destinations:  []string{"jwt-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
 			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updUser := updateManager.CreateChannel(ctx, userPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, userPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	userAuth := auth.UserAuth{
-		AccountId: accountID,
-		UserId:    userID,
-		Groups:    []string{"jwt-linked"},
-	}
-
-	t.Run("adding JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+		}, true)
 		require.NoError(t, err)
-		assert.Contains(t, user.AutoGroups, "jwt-grp")
-	})
 
-	t.Run("removing JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+		updUser := updateManager.CreateChannel(ctx, userPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, userPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
+		})
 
-		userAuth.Groups = nil
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+		userAuth := auth.UserAuth{
+			AccountId: accountID,
+			UserId:    userID,
+			Groups:    []string{"jwt-linked"},
+		}
 
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "adding JWT group updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updUser, upd2, upd3)
 
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.NotContains(t, user.AutoGroups, "jwt-grp")
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.Contains(t, user.AutoGroups, "jwt-grp")
+		})
+
+		step(t, "removing JWT group updates only linked peers", func(t *testing.T) {
+			drainPeerUpdates(updUser)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			userAuth.Groups = nil
+			require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
+
+			peerShouldReceiveUpdate(t, updUser)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
+			require.NoError(t, err)
+			assert.NotContains(t, user.AutoGroups, "jwt-grp")
+		})
 	})
 }

management/server/affected_peers_oldstate_test.go

@@ -24,120 +24,124 @@ import (
 // detaching one of them must still refresh that group's policy source peers, even
 // though the post-update resource no longer maps to it.
 func TestAffectedPeers_E2E_UpdateResource_DetachGroup_RefreshesOldGroupSources(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A second resource group + a second source group/peer that reaches the
-	// resource only through that second group.
-	const detachGroupID = "rs-detach-grp"
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
+		// A second resource group + a second source group/peer that reaches the
+		// resource only through that second group.
+		const detachGroupID = "rs-detach-grp"
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"}))
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID, detachGroupID},
-		Enabled:   true,
+		// Attach the resource to the detach group as well: now in [resourceGroup, detachGroup].
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID, detachGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		// Policy granting the second source group access via the detach group.
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
+		require.NoError(t, err)
+
+		secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
+		settleAffectedUpdates(secondSrcCh)
+
+		done := make(chan struct{})
+		go func() {
+			// Detaching the resource from detachGroup removes the second source's
+			// access; that source peer must be refreshed even though the post-update
+			// resource no longer maps to detachGroup.
+			peerShouldReceiveUpdate(t, secondSrcCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
+		}
 	})
-	require.NoError(t, err)
-
-	// Policy granting the second source group access via the detach group.
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true)
-	require.NoError(t, err)
-
-	secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) })
-	settleAffectedUpdates(secondSrcCh)
-
-	done := make(chan struct{})
-	go func() {
-		// Detaching the resource from detachGroup removes the second source's
-		// access; that source peer must be refreshed even though the post-update
-		// resource no longer maps to detachGroup.
-		peerShouldReceiveUpdate(t, secondSrcCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID}, // detached detachGroup
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer")
-	}
 }
 
 // TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer:
 // changing router.Peer within the same network must still refresh the OLD routing
 // peer, which loses its routing role.
 func TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	_, routersManager, _ := s.managers()
+		_, routersManager, _ := s.managers()
 
-	routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
-	require.NoError(t, err)
-	require.Len(t, routers, 1)
-	router := routers[0]
-	oldRoutingPeer := router.Peer
-	require.NotEmpty(t, oldRoutingPeer)
+		routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID)
+		require.NoError(t, err)
+		require.Len(t, routers, 1)
+		router := routers[0]
+		oldRoutingPeer := router.Peer
+		require.NotEmpty(t, oldRoutingPeer)
 
-	// A new peer to become the routing peer in place of the old one.
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		// A new peer to become the routing peer in place of the old one.
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
 
-	oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
-	t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
-	settleAffectedUpdates(oldCh)
+		oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer)
+		t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) })
+		settleAffectedUpdates(oldCh)
 
-	done := make(chan struct{})
-	go func() {
-		// The old routing peer stops serving the resource and must be refreshed.
-		peerShouldReceiveUpdate(t, oldCh)
-		close(done)
-	}()
+		done := make(chan struct{})
+		go func() {
+			// The old routing peer stops serving the resource and must be refreshed.
+			peerShouldReceiveUpdate(t, oldCh)
+			close(done)
+		}()
 
-	_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		ID:         router.ID,
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       newRoutingPeer.ID, // repoint within the same network
-		Masquerade: true,
-		Metric:     9999,
-		Enabled:    true,
+		_, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			ID:         router.ID,
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       newRoutingPeer.ID, // repoint within the same network
+			Masquerade: true,
+			Metric:     9999,
+			Enabled:    true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
+		}
 	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the router peer did not refresh the old routing peer")
-	}
 }

management/server/affected_peers_router_paths_test.go

@@ -165,148 +165,154 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context
 }
 
 func TestAffectedPeers_E2E_SavePostureCheck_RefreshesRoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
+		checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID))
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
+			ID:   checkID,
+			Name: "rs-min-version",
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
+			},
+		}, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: editing a posture check did not refresh source + routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{
-		ID:   checkID,
-		Name: "rs-min-version",
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"},
-		},
-	}, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: editing a posture check did not refresh source + routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdateResource_DestinationResourcePolicy_RefreshesSourcePeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
 
-	resourcesManager, _, _ := s.managers()
+		resourcesManager, _, _ := s.managers()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer")
-	}
 }
 
 // A disabled sibling router routes to nobody, so updating a resource on its network
 // must NOT refresh its peer (the enabled router carries the bridge instead).
 func TestAffectedPeers_E2E_UpdateResource_DisabledSiblingRouterNotBridged(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	resourcesManager, routersManager, _ := s.managers()
+		resourcesManager, routersManager, _ := s.managers()
 
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
-		NetworkID:  s.networkID,
-		AccountID:  s.accountID,
-		Peer:       disabledRouterPeer.ID,
-		Masquerade: true,
-		Metric:     9000,
-		Enabled:    false,
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		_, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{
+			NetworkID:  s.networkID,
+			AccountID:  s.accountID,
+			Peer:       disabledRouterPeer.ID,
+			Masquerade: true,
+			Metric:     9000,
+			Enabled:    false,
+		})
+		require.NoError(t, err)
+
+		disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
+		enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(disabledCh, enabledCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, enabledCh)
+			peerShouldNotReceiveUpdate(t, disabledCh)
+			close(done)
+		}()
+
+		_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/25",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout")
+		}
 	})
-	require.NoError(t, err)
-
-	disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID)
-	enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-	})
-
-	settleAffectedUpdates(disabledCh, enabledCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, enabledCh)
-		peerShouldNotReceiveUpdate(t, disabledCh)
-		close(done)
-	}()
-
-	_, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/25",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout")
-	}
 }
 
 func TestAffectedPeers_GroupChange_RouterInOtherNetworkNotAffected(t *testing.T) {
@@ -346,8 +352,10 @@ func TestAffectedPeers_PeerChange_RouterInOtherNetworkNotAffected(t *testing.T)
 // shortcut (the denied peer's map holds no router) and the allow direction
 // depends on which meta field moved, leaving the routers with a stale map.
 func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)
+		})
 	})
 }
 
@@ -355,8 +363,10 @@ func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) {
 // scenario with the source peer named directly in the rule: it must receive its posture
 // checks and have its flips detected exactly like a group member.
 func TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer(t *testing.T) {
-	runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
-		return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy {
+			return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID)
+		})
 	})
 }
 

management/server/affected_peers_router_test.go

@@ -8,7 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	"github.com/netbirdio/netbird/management/server/groups"
@@ -320,190 +319,189 @@ func TestAffectedPeers_PolicyToResource_UnrelatedPeerNotAffected(t *testing.T) {
 }
 
 func TestAffectedPeers_ResourceSideBridgesToRoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	// A pre-existing policy grants the source group access to the resource.
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		// A pre-existing policy grants the source group access to the resource.
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	// Drive an update through the resource manager and assert the routing peer
-	// is among the affected set by observing the channel. This path walks
-	// policies whose destinations reference the resource's groups, folds in the
-	// source groups, and loads the network's routers, so it reaches both the
-	// source peer and the routing peer.
-	permissionsManager := permissions.NewManager(s.manager.Store)
-	groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
-	rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
+		// Drive an update through the resource manager and assert the routing peer
+		// is among the affected set by observing the channel. This path walks
+		// policies whose destinations reference the resource's groups, folds in the
+		// source groups, and loads the network's routers, so it reaches both the
+		// source peer and the routing peer.
+		permissionsManager := permissions.NewManager(s.manager.Store)
+		groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager)
+		rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
+			ID:        s.resourceID,
+			AccountID: s.accountID,
+			NetworkID: s.networkID,
+			Name:      "rs-resource-host",
+			Address:   "10.20.30.0/24",
+			GroupIDs:  []string{s.resourceGroupID},
+			Enabled:   true,
+		})
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: resource update did not refresh source peer + routing peer")
+		}
 	})
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{
-		ID:        s.resourceID,
-		AccountID: s.accountID,
-		NetworkID: s.networkID,
-		Name:      "rs-resource-host",
-		Address:   "10.20.30.0/24",
-		GroupIDs:  []string{s.resourceGroupID},
-		Enabled:   true,
-	})
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: resource update did not refresh source peer + routing peer")
-	}
-}
-
-// settleAffectedUpdates waits for in-flight async updates to arrive, then drains
-// every given channel so subsequent assertions start from a clean slate.
-//
-// Setup (CreateNetwork/CreateResource/CreateRouter) fires async UpdateAffectedPeers
-// goroutines; draining first means the assertion only observes updates from the
-// action under test, not setup stragglers.
-func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) {
-	time.Sleep(300 * time.Millisecond)
-	for _, ch := range chans {
-		drainPeerUpdates(ch)
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_DirectRouter(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, s.unrelatedPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			peerShouldNotReceiveUpdate(t, unrelatedCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh, unrelatedCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		peerShouldNotReceiveUpdate(t, unrelatedCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: creating peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: routing peer not refreshed when policy targets DestinationResource")
-	}
 }
 
 func TestAffectedPeers_E2E_DeletePolicy_RoutingPeer(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID))
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: deleting peer->resource policy did not refresh the routing peer")
-	}
 }
 
 func (s *routerScenario) managers() (resources.Manager, routers.Manager, networks.Manager) {
@@ -572,113 +570,119 @@ func (s *routerScenario) addSecondTopology(t *testing.T, suffix string) secondTo
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_BothRoutingPeers(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	second := s.addSecondTopology(t, "b")
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		second := s.addSecondTopology(t, "b")
+		ctx := context.Background()
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
-		s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+			s.updateManager.CloseChannel(ctx, second.routerPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerACh, routerBCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerACh)
+			peerShouldReceiveUpdate(t, routerBCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Destinations = []string{second.resourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerACh, routerBCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerACh)
-		peerShouldReceiveUpdate(t, routerBCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Destinations = []string{second.resourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: re-pointing the policy destination did not refresh both routing peers")
-	}
 }
 
 func TestAffectedPeers_E2E_UpdatePolicy_AddSource(t *testing.T) {
-	s := setupRouterScenario(t, true)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, true)
+		ctx := context.Background()
 
-	const secondSourceGroupID = "rs-source-grp-2"
-	setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
-	require.NoError(t, err)
-	secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
-	require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
-		ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
-	}))
+		const secondSourceGroupID = "rs-source-grp-2"
+		setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		require.NoError(t, err)
+		secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key)
+		require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{
+			ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID},
+		}))
 
-	policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
-	require.NoError(t, err)
+		policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true)
+		require.NoError(t, err)
 
-	newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
-		s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, secondSourcePeer.ID)
+			s.updateManager.CloseChannel(ctx, s.routerPeerID)
+		})
+
+		settleAffectedUpdates(newSrcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, newSrcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
+		_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
+		}
 	})
-
-	settleAffectedUpdates(newSrcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, newSrcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID}
-	_, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: adding a source group did not refresh the new source peer + routing peer")
-	}
 }
 
 func TestAffectedPeers_E2E_DestResource_RouterPeerGroups(t *testing.T) {
-	s := setupRouterScenario(t, false)
-	ctx := context.Background()
+	runPeerUpdateTest(t, func(t *testing.T) {
+		s := setupRouterScenario(t, false)
+		ctx := context.Background()
 
-	srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
-	routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
-	t.Cleanup(func() {
-		s.updateManager.CloseChannel(ctx, s.sourcePeerID)
-		s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID)
+		routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID)
+		t.Cleanup(func() {
+			s.updateManager.CloseChannel(ctx, s.sourcePeerID)
+			s.updateManager.CloseChannel(ctx, s.routerGroupPeerID)
+		})
+
+		settleAffectedUpdates(srcCh, routerCh)
+
+		done := make(chan struct{})
+		go func() {
+			peerShouldReceiveUpdate(t, srcCh)
+			peerShouldReceiveUpdate(t, routerCh)
+			close(done)
+		}()
+
+		_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
+		require.NoError(t, err)
+
+		select {
+		case <-done:
+		case <-time.After(peerUpdateTimeout):
+			t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
+		}
 	})
-
-	settleAffectedUpdates(srcCh, routerCh)
-
-	done := make(chan struct{})
-	go func() {
-		peerShouldReceiveUpdate(t, srcCh)
-		peerShouldReceiveUpdate(t, routerCh)
-		close(done)
-	}()
-
-	_, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true)
-	require.NoError(t, err)
-
-	select {
-	case <-done:
-	case <-time.After(peerUpdateTimeout):
-		t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer")
-	}
 }
 
 func TestAffectedPeers_AllRoutingPeers_Network(t *testing.T) {

management/server/affected_peers_user_test.go

@@ -17,154 +17,152 @@ import (
 // A user update refreshes only the peers its auto-group change reaches, and a user
 // update that changes no group membership refreshes nobody.
 func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
+		ctx := context.Background()
+		accountID := account.Id
 
-	const targetUserID = "target-user"
-	require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
-		Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-	}))
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
-	}, false)
-	require.NoError(t, err)
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
-
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
-
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ug-linked"},
-				Destinations:  []string{"ug-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, targetPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("auto group change updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+		const targetUserID = "target-user"
+		require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
 			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"},
-		})
+		}))
+
+		key, err := wgtypes.GeneratePrivateKey()
+		require.NoError(t, err)
+		targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
+			Key:  key.PublicKey().String(),
+			Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
+		}, false)
 		require.NoError(t, err)
 
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("update without group changes refreshes nobody", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"}, Name: "renamed",
-		})
+		policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
 		require.NoError(t, err)
+		for _, p := range policies {
+			require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+		}
 
-		peerShouldNotReceiveUpdate(t, updTarget)
-		peerShouldNotReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+		account, err = manager.Store.GetAccount(ctx, accountID)
 		require.NoError(t, err)
-		assert.Equal(t, "renamed", user.Name)
-	})
-
-	t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
-		account, err := manager.Store.GetAccount(ctx, accountID)
-		require.NoError(t, err)
-		account.Settings.IPv6EnabledGroups = []string{"ug-v6"}
+		account.Settings.GroupsPropagationEnabled = true
 		require.NoError(t, manager.Store.SaveAccount(ctx, account))
-		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
 
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
+		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
 
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		// The reassigned peer refreshes with everyone it can reach: peer2 via the
-		// policy, but not peer3, which shares no group or policy with it.
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
-		// An SSH rule that authorizes no group of its own ships the account's
-		// allowed-user set to its destinations, so those are the peers an unblock
-		// reaches — not the whole account.
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+		_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
 			Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled:      true,
-				Sources:      []string{"ug-linked"},
-				Destinations: []string{"ug-dest"},
-				Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-				Action:       types.PolicyTrafficActionAccept,
-			}},
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"ug-linked"},
+					Destinations:  []string{"ug-dest"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
 		}, true)
 		require.NoError(t, err)
 
-		blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		blocked.Blocked = true
-		require.NoError(t, manager.Store.SaveUser(ctx, blocked))
-
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		// Same auto-groups as the previous subtest left them, so no group change and
-		// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+		updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
+		upd2 := updateManager.CreateChannel(ctx, peer2.ID)
+		upd3 := updateManager.CreateChannel(ctx, peer3.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(ctx, targetPeer.ID)
+			updateManager.CloseChannel(ctx, peer2.ID)
+			updateManager.CloseChannel(ctx, peer3.ID)
 		})
-		require.NoError(t, err)
 
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
+		step(t, "auto group change updates only linked peers", func(t *testing.T) {
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"},
+			})
+			require.NoError(t, err)
+
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+
+		step(t, "update without group changes refreshes nobody", func(t *testing.T) {
+			drainPeerUpdates(updTarget)
+			drainPeerUpdates(upd2)
+			drainPeerUpdates(upd3)
+
+			_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			peerShouldNotReceiveUpdate(t, updTarget)
+			peerShouldNotReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+
+			user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			assert.Equal(t, "renamed", user.Name)
+		})
+
+		step(t, "auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
+
+			require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))// Apply through the settings API so the reconciliation that strips the other
+		// peers' addresses happens here, leaving the target as the only peer the
+		// user update reassigns.
+		updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) {
+			s.IPv6EnabledGroups = []string{"ug-v6"}
+		})
+
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			// The reassigned peer refreshes with everyone it can reach: peer2 via the
+			// policy, but not peer3, which shares no group or policy with it.
+			peerShouldReceiveUpdate(t, updTarget)
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
+
+		step(t, "unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
+			// An SSH rule that authorizes no group of its own ships the account's
+			// allowed-user set to its destinations, so those are the peers an unblock
+			// reaches — not the whole account.
+			_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{{
+					Enabled:      true,
+					Sources:      []string{"ug-linked"},
+					Destinations: []string{"ug-dest"},
+					Protocol:     types.PolicyRuleProtocolNetbirdSSH,
+					Action:       types.PolicyTrafficActionAccept,
+				}},
+			}, true)
+			require.NoError(t, err)
+
+			blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
+			require.NoError(t, err)
+			blocked.Blocked = true
+			require.NoError(t, manager.Store.SaveUser(ctx, blocked))
+
+			settleAffectedUpdates(updTarget, upd2, upd3)
+
+			// Same auto-groups as the previous subtest left them, so no group change and
+			// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
+			_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
+				Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
+				AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
+			})
+			require.NoError(t, err)
+
+			peerShouldReceiveUpdate(t, upd2)
+			peerShouldNotReceiveUpdate(t, upd3)
+		})
 	})
 }

management/server/affected_peers_zone_test.go

@@ -0,0 +1,145 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/server/affectedpeers"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const affectedZoneDomain = "zone.test"
+
+// createAffectedZone stores a zone distributed to the given groups, optionally with
+// one A record so the network map actually ships it.
+func createAffectedZone(t *testing.T, s store.Store, accountID, domain string, enabled, withRecord bool, groups []string) *zones.Zone {
+	t.Helper()
+	ctx := context.Background()
+
+	zone := zones.NewZone(accountID, domain, domain, enabled, false, groups)
+	require.NoError(t, s.CreateZone(ctx, zone))
+
+	if withRecord {
+		record := records.NewRecord(accountID, zone.ID, "host."+domain, records.RecordTypeA, "10.0.0.1", 300)
+		require.NoError(t, s.CreateDNSRecord(ctx, record))
+	}
+
+	return zone
+}
+
+func TestCollectGroupChange_ZoneLinked(t *testing.T) {
+	_, s, accountID, _, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	createAffectedZone(t, s, accountID, affectedZoneDomain, true, true, []string{groupIDs[0]})
+
+	groups, _ := collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[0]})
+	assert.Contains(t, groups, groupIDs[0], "group distributed a zone should be affected by its own change")
+
+	groups, _ = collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[1]})
+	assert.Empty(t, groups, "group not referenced by any zone should not be affected")
+}
+
+func TestCollectGroupChange_UnshippedZoneNotLinked(t *testing.T) {
+	_, s, accountID, _, groupIDs := setupAffectedPeersTest(t)
+	ctx := context.Background()
+
+	// Disabled zone and zone without records are never shipped by the network map.
+	createAffectedZone(t, s, accountID, "disabled."+affectedZoneDomain, false, true, []string{groupIDs[0]})
+	createAffectedZone(t, s, accountID, "empty."+affectedZoneDomain, true, false, []string{groupIDs[1]})
+
+	groups, _ := collectGroupChangeAffectedGroups(ctx, s, accountID, []string{groupIDs[0], groupIDs[1]})
+	assert.Empty(t, groups, "groups referenced only by unshipped zones should not be affected")
+}
+
+func TestResolveAffectedPeers_ZoneGroupMembershipChange(t *testing.T) {
+	_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+
+	createAffectedZone(t, s, accountID, affectedZoneDomain, true, true, []string{groupIDs[0]})
+
+	// Same change shape UpdateGroup builds: the group changed as a whole and peer1
+	// left it, so peer1 must refresh to drop the zone.
+	change := affectedpeers.Change{
+		ChangedGroupIDs:     []string{groupIDs[0]},
+		RemovedPeersByGroup: map[string][]string{groupIDs[0]: {peerIDs[1]}},
+	}
+
+	result := resolveAffected(t, s, accountID, change)
+	assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[1]}, result, "current and removed members of the zone group should be affected")
+}
+
+func TestResolveAffectedPeers_ZoneDistributionChange(t *testing.T) {
+	_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
+
+	// Zone create/update/delete passes old and new distribution groups.
+	change := affectedpeers.Change{DistributionGroupIDs: []string{groupIDs[0], groupIDs[2]}}
+
+	result := resolveAffected(t, s, accountID, change)
+	assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[2]}, result, "only members of the distribution groups should be affected")
+}
+
+// TestAffectedPeers_ZoneGroupUpdate_NewMemberReceivesZone verifies that adding a peer
+// to a group referenced only by a zone pushes the zone to the new member and leaves
+// unrelated peers alone.
+func TestAffectedPeers_ZoneGroupUpdate_NewMemberReceivesZone(t *testing.T) {
+	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	ctx := context.Background()
+	accountID := account.Id
+
+	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	for _, p := range policies {
+		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
+	}
+
+	zoneGroup := &types.Group{ID: "zone-grp", Name: "ZoneGroup", Peers: []string{peer1.ID}}
+	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, zoneGroup))
+
+	createAffectedZone(t, manager.Store, accountID, affectedZoneDomain, true, true, []string{zoneGroup.ID})
+
+	updMsg1 := updateManager.CreateChannel(ctx, peer1.ID)
+	updMsg2 := updateManager.CreateChannel(ctx, peer2.ID)
+	updMsg3 := updateManager.CreateChannel(ctx, peer3.ID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, peer1.ID)
+		updateManager.CloseChannel(ctx, peer2.ID)
+		updateManager.CloseChannel(ctx, peer3.ID)
+	})
+
+	zoneGroup.Peers = []string{peer1.ID, peer2.ID}
+	require.NoError(t, manager.UpdateGroup(ctx, accountID, userID, zoneGroup))
+
+	peerShouldReceiveUpdate(t, updMsg1)
+	msg := receivePeerUpdate(t, updMsg2)
+	assert.True(t, syncHasCustomZone(msg, affectedZoneDomain+"."), "new zone group member should receive the zone")
+	peerShouldNotReceiveUpdate(t, updMsg3)
+}
+
+func receivePeerUpdate(t *testing.T, ch <-chan *network_map.UpdateMessage) *network_map.UpdateMessage {
+	t.Helper()
+	select {
+	case msg := <-ch:
+		require.NotNil(t, msg, "update message should not be nil")
+		return msg
+	case <-time.After(peerUpdateTimeout):
+		require.FailNow(t, "timed out waiting for update message")
+		return nil
+	}
+}
+
+func syncHasCustomZone(msg *network_map.UpdateMessage, domain string) bool {
+	for _, zone := range msg.Update.GetNetworkMap().GetDNSConfig().GetCustomZones() {
+		if zone.GetDomain() == domain {
+			return true
+		}
+	}
+	return false
+}

management/server/affectedpeers/resolver.go

@@ -22,6 +22,7 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -50,6 +51,7 @@ type Snapshot struct {
 	policies       []*types.Policy
 	routes         []*route.Route
 	nsGroups       []*nbdns.NameServerGroup
+	zones          []*zones.Zone
 	dnsSettings    *types.DNSSettings
 	routers        []*routerTypes.NetworkRouter
 	resources      []*resourceTypes.NetworkResource
@@ -127,12 +129,15 @@ func (snap *Snapshot) loadRoutesAndProxy(ctx context.Context, s store.Store, acc
 	return snap.loadProxyServices(ctx, s, accountID)
 }
 
-// loadDNS loads the nameserver groups and account DNS settings.
+// loadDNS loads the nameserver groups, custom DNS zones and account DNS settings.
 func (snap *Snapshot) loadDNS(ctx context.Context, s store.Store, accountID string) error {
 	var err error
 	if snap.nsGroups, err = s.GetAccountNameServerGroups(ctx, store.LockingStrengthNone, accountID); err != nil {
 		return err
 	}
+	if snap.zones, err = s.GetAccountZones(ctx, store.LockingStrengthNone, accountID); err != nil {
+		return err
+	}
 	snap.dnsSettings, err = s.GetAccountDNSSettings(ctx, store.LockingStrengthNone, accountID)
 	return err
 }
@@ -357,7 +362,7 @@ func (s policySide) opposite() policySide {
 //   - a changed router/resource/network sits on a NETWORK -> fold the SOURCE side of
 //     the policies whose destination reaches it (and the routers it implies).
 //
-// Routes, nameserver groups, DNS and embedded-proxy services distribute to their own
+// Routes, nameserver groups, DNS zones, DNS and embedded-proxy services distribute to their own
 // member peers, outside the policy graph, and are folded here too.
 func (r *resolver) walk() {
 	for _, policy := range r.bothSidesPolicies() {
@@ -369,6 +374,7 @@ func (r *resolver) walk() {
 		r.collectFromPolicies()
 		r.collectFromRoutes()
 		r.collectFromNameServers()
+		r.collectFromZones()
 		r.collectFromDNSSettings()
 		r.collectFromNetworkRouters()
 		r.collectFromProxyServices()
@@ -829,6 +835,25 @@ func (r *resolver) collectFromNameServers() {
 	}
 }
 
+// collectFromZones folds the distribution groups of the custom DNS zones that
+// reference a linked group. Like nameserver groups, a zone has no opposite side, so
+// only a whole-group change folds its groups. Zones the network map does not ship
+// (disabled or without records) are skipped.
+func (r *resolver) collectFromZones() {
+	if len(r.linkGroups) == 0 {
+		return
+	}
+	for _, zone := range r.snap.zones {
+		if !zone.Enabled || len(zone.Records) == 0 {
+			continue
+		}
+		if anyInSet(zone.DistributionGroups, r.linkGroups) {
+			log.WithContext(r.ctx).Tracef("collectFromZones: zone %s references a linked group -> folding its groups %v (outputGroups only)", zone.ID, zone.DistributionGroups)
+			r.foldOutputGroups(zone.DistributionGroups)
+		}
+	}
+}
+
 // collectFromSSHAuthorizedGroups folds the destinations of the enabled SSH rules that
 // authorize a group whose user membership changed. Those destination peers carry the
 // group -> user mapping for the groups they authorize, so they refresh even when no

management/server/api/v1alpha1/groups/helpers.go

@@ -0,0 +1,38 @@
+package groups
+
+import (
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+)
+
+func ToGroupsInfoMap(groups []*types.Group, idCount int) map[string][]apiv1alpha1.GroupMinimum {
+	groupsInfoMap := make(map[string][]apiv1alpha1.GroupMinimum, idCount)
+	groupsChecked := make(map[string]struct{}, len(groups)) // not sure why this is needed (left over from old implementation)
+	for _, group := range groups {
+		_, ok := groupsChecked[group.ID]
+		if ok {
+			continue
+		}
+
+		groupsChecked[group.ID] = struct{}{}
+		for _, pk := range group.Peers {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[pk] = append(groupsInfoMap[pk], info)
+		}
+		for _, rk := range group.Resources {
+			info := apiv1alpha1.GroupMinimum{
+				Id:             group.ID,
+				Name:           group.Name,
+				PeersCount:     len(group.Peers),
+				ResourcesCount: len(group.Resources),
+			}
+			groupsInfoMap[rk.ID] = append(groupsInfoMap[rk.ID], info)
+		}
+	}
+	return groupsInfoMap
+}

management/server/api/v1alpha1/handler.go

@@ -0,0 +1,38 @@
+package v1alpha1
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/netbirdio/netbird/management/server/permissions"
+
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/peers"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/users"
+)
+
+func NewAPIV1Handler(
+	ctx context.Context,
+	router *mux.Router,
+	accountManager account.Manager,
+	networkMapController network_map.Controller,
+	permissionsManager permissions.Manager) (http.Handler, error) {
+
+	v1validatorMiddleware, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+	if err != nil {
+		return nil, err
+	}
+
+	router.Use(v1validatorMiddleware.Handler)
+
+	peersHandler := peers.NewHandler(accountManager, networkMapController, permissionsManager)
+	_ = peersHandler.WithEndpointsForRouter(router)
+
+	usersHandler := users.NewHandler(accountManager)
+	return usersHandler.WithEndpointsForRouter(router), nil
+}

management/server/api/v1alpha1/peers/peers_handler.go

@@ -0,0 +1,418 @@
+package peers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/netip"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/api/v1alpha1/groups"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+type Handler struct {
+	accountManager       account.Manager
+	permissionsManager   permissions.Manager
+	networkMapController network_map.Controller
+}
+
+// NewHandler creates a new peers Handler
+func NewHandler(accountManager account.Manager, networkMapController network_map.Controller, permissionsManager permissions.Manager) *Handler {
+	return &Handler{
+		accountManager:       accountManager,
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/peers", h.GetAllPeers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/peers/{peerId}", h.HandlePeer).Methods("GET", "PUT", "DELETE", "OPTIONS")
+	return router
+}
+
+func (h *Handler) getPeer(ctx context.Context, accountID, peerID, userID string, w http.ResponseWriter) {
+	peer, err := h.accountManager.GetPeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	if peer.ProxyMeta.Embedded {
+		util.WriteError(ctx, status.Errorf(status.InvalidArgument, "not allowed to read peer"), w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetPeerGroups(ctx, accountID, peerID)
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to list approved peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(ctx, w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) updatePeer(ctx context.Context, accountID, userID, peerID string, w http.ResponseWriter, r *http.Request) {
+	req := &apiv1alpha1.PeerRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	update := &nbpeer.Peer{
+		ID:                          peerID,
+		SSHEnabled:                  req.SshEnabled,
+		Name:                        req.Name,
+		LoginExpirationEnabled:      req.LoginExpirationEnabled,
+		InactivityExpirationEnabled: req.InactivityExpirationEnabled,
+	}
+
+	if req.ApprovalRequired != nil {
+		// todo: looks like that we reset all status property, is it right?
+		update.Status = &nbpeer.PeerStatus{
+			RequiresApproval: *req.ApprovalRequired,
+		}
+	}
+
+	if req.Ip != nil {
+		addr, err := netip.ParseAddr(*req.Ip)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "invalid IP address %s: %v", *req.Ip, err), w)
+			return
+		}
+
+		if err = h.accountManager.UpdatePeerIP(ctx, accountID, userID, peerID, addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	if req.Ipv6 != nil {
+		v6Addr, err := parseIPv6(req.Ipv6)
+		if err != nil {
+			util.WriteError(ctx, status.Errorf(status.InvalidArgument, "%v", err), w)
+			return
+		}
+		if err = h.accountManager.UpdatePeerIPv6(ctx, accountID, userID, peerID, v6Addr); err != nil {
+			util.WriteError(ctx, err, w)
+			return
+		}
+	}
+
+	peer, err := h.accountManager.UpdatePeer(ctx, accountID, userID, update)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(ctx, accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	peerGroups, err := h.accountManager.GetPeerGroups(ctx, accountID, peer.ID)
+	if err != nil {
+		util.WriteError(ctx, err, w)
+		return
+	}
+
+	grpsInfoMap := groups.ToGroupsInfoMap(peerGroups, 0)
+
+	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(ctx, fmt.Errorf("internal error"), w)
+		return
+	}
+
+	_, valid := validPeers[peer.ID]
+	reason := invalidPeers[peer.ID]
+
+	util.WriteJSONObject(r.Context(), w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+}
+
+func (h *Handler) deletePeer(ctx context.Context, accountID, userID string, peerID string, w http.ResponseWriter) {
+	err := h.accountManager.DeletePeer(ctx, accountID, peerID, userID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete peer: %v", err)
+		util.WriteError(ctx, err, w)
+		return
+	}
+	util.WriteJSONObject(ctx, w, util.EmptyObject{})
+}
+
+// HandlePeer handles all peer requests for GET, PUT and DELETE operations
+func (h *Handler) HandlePeer(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	peerID := vars["peerId"]
+	if len(peerID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid peer ID"), w)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodDelete:
+		h.deletePeer(r.Context(), accountID, userID, peerID, w)
+		return
+	case http.MethodGet:
+		h.getPeer(r.Context(), accountID, peerID, userID, w)
+		return
+	case http.MethodPut:
+		h.updatePeer(r.Context(), accountID, userID, peerID, w, r)
+		return
+	default:
+		util.WriteError(r.Context(), status.Errorf(status.NotFound, "unknown METHOD"), w)
+	}
+}
+
+// GetAllPeers returns a list of all peers associated with a provided account
+func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	nameFilter := r.URL.Query().Get("name")
+	ipFilter := r.URL.Query().Get("ip")
+	macFilter := r.URL.Query().Get("mac")
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	settings, err := h.accountManager.GetAccountSettings(r.Context(), accountID, activity.SystemInitiator)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	dnsDomain := h.networkMapController.GetDNSDomain(settings)
+
+	grps, _ := h.accountManager.GetAllGroups(r.Context(), accountID, userID)
+
+	grpsInfoMap := groups.ToGroupsInfoMap(grps, len(peers))
+	respBody := make([]*apiv1alpha1.PeerBatch, 0, len(peers))
+	for _, peer := range peers {
+		if peer.ProxyMeta.Embedded {
+			continue
+		}
+		respBody = append(respBody, toPeerListItemResponse(peer, grpsInfoMap[peer.ID], dnsDomain, 0))
+	}
+
+	validPeersMap, invalidPeersMap, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	if err != nil {
+		log.WithContext(r.Context()).Errorf("failed to get validated peers: %v", err)
+		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
+		return
+	}
+	h.setApprovalRequiredFlag(respBody, validPeersMap, invalidPeersMap)
+
+	util.WriteJSONObject(r.Context(), w, respBody)
+}
+
+func (h *Handler) setApprovalRequiredFlag(respBody []*apiv1alpha1.PeerBatch, validPeersMap map[string]struct{}, invalidPeersMap map[string]string) {
+	for _, peer := range respBody {
+		_, ok := validPeersMap[peer.Id]
+		if !ok {
+			peer.ApprovalRequired = true
+
+			reason := invalidPeersMap[peer.Id]
+			peer.DisapprovalReason = &reason
+		}
+	}
+}
+
+func parseIPv6(s *string) (netip.Addr, error) {
+	if s == nil {
+		return netip.Addr{}, fmt.Errorf("IPv6 address is nil")
+	}
+	addr, err := netip.ParseAddr(*s)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("invalid IPv6 address %s: %w", *s, err)
+	}
+	addr = addr.Unmap()
+	if !addr.Is6() {
+		return netip.Addr{}, fmt.Errorf("address %s is not IPv6", *s)
+	}
+	return addr, nil
+}
+
+func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, approved bool, reason string) *apiv1alpha1.Peer {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	apiPeer := &apiv1alpha1.Peer{
+		PeerMinimum: apiv1alpha1.PeerMinimum{
+			Id:   peer.ID,
+			Name: peer.Name,
+		},
+		CreatedAt:                   peer.CreatedAt,
+		Ip:                          peer.IP.String(),
+		Ipv6:                        peerIPv6String(peer),
+		ConnectionIp:                peer.Location.ConnectionIP.String(),
+		Connected:                   peer.Status.Connected,
+		LastSeen:                    peer.Status.LastSeen,
+		Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+		KernelVersion:               peer.Meta.KernelVersion,
+		GeonameId:                   int(peer.Location.GeoNameID),
+		Version:                     peer.Meta.WtVersion,
+		Groups:                      groupsInfo,
+		SshEnabled:                  peer.SSHEnabled,
+		Hostname:                    peer.Meta.Hostname,
+		UserId:                      peer.UserID,
+		UiVersion:                   peer.Meta.UIVersion,
+		DnsLabel:                    fqdn(peer, dnsDomain),
+		ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+		LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+		LastLogin:                   peer.GetLastLogin(),
+		LoginExpired:                peer.Status.LoginExpired,
+		ApprovalRequired:            !approved,
+		CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+		CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+		SerialNumber:                peer.Meta.SystemSerialNumber,
+		InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+		Ephemeral:                   peer.Ephemeral,
+		LocalFlags: &apiv1alpha1.PeerLocalFlags{
+			BlockInbound:          &peer.Meta.Flags.BlockInbound,
+			BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+			DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+			DisableDns:            &peer.Meta.Flags.DisableDNS,
+			DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+			DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+			LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+			RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+			RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+			ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+			RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+		},
+	}
+
+	if !approved {
+		apiPeer.DisapprovalReason = &reason
+	}
+
+	return apiPeer
+}
+
+func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []apiv1alpha1.GroupMinimum, dnsDomain string, accessiblePeersCount int) *apiv1alpha1.PeerBatch {
+	osVersion := peer.Meta.OSVersion
+	if osVersion == "" {
+		osVersion = peer.Meta.Core
+	}
+
+	return &apiv1alpha1.PeerBatch{
+		CreatedAt:            peer.CreatedAt,
+		AccessiblePeersCount: accessiblePeersCount,
+		Peer: apiv1alpha1.Peer{
+			PeerMinimum: apiv1alpha1.PeerMinimum{
+				Id:   peer.ID,
+				Name: peer.Name,
+			},
+			Ip:                          peer.IP.String(),
+			Ipv6:                        peerIPv6String(peer),
+			ConnectionIp:                peer.Location.ConnectionIP.String(),
+			Connected:                   peer.Status.Connected,
+			LastSeen:                    peer.Status.LastSeen,
+			Os:                          fmt.Sprintf("%s %s", peer.Meta.OS, osVersion),
+			KernelVersion:               peer.Meta.KernelVersion,
+			GeonameId:                   int(peer.Location.GeoNameID),
+			Version:                     peer.Meta.WtVersion,
+			Groups:                      groupsInfo,
+			SshEnabled:                  peer.SSHEnabled,
+			Hostname:                    peer.Meta.Hostname,
+			UserId:                      peer.UserID,
+			UiVersion:                   peer.Meta.UIVersion,
+			DnsLabel:                    fqdn(peer, dnsDomain),
+			ExtraDnsLabels:              fqdnList(peer.ExtraDNSLabels, dnsDomain),
+			LoginExpirationEnabled:      peer.LoginExpirationEnabled,
+			LastLogin:                   peer.GetLastLogin(),
+			LoginExpired:                peer.Status.LoginExpired,
+			CountryCode:                 apiv1alpha1.CountryCode(peer.Location.CountryCode),
+			CityName:                    apiv1alpha1.CityName(peer.Location.CityName),
+			SerialNumber:                peer.Meta.SystemSerialNumber,
+			InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
+			Ephemeral:                   peer.Ephemeral,
+			LocalFlags: &apiv1alpha1.PeerLocalFlags{
+				BlockInbound:          &peer.Meta.Flags.BlockInbound,
+				BlockLanAccess:        &peer.Meta.Flags.BlockLANAccess,
+				DisableClientRoutes:   &peer.Meta.Flags.DisableClientRoutes,
+				DisableDns:            &peer.Meta.Flags.DisableDNS,
+				DisableFirewall:       &peer.Meta.Flags.DisableFirewall,
+				DisableServerRoutes:   &peer.Meta.Flags.DisableServerRoutes,
+				LazyConnectionEnabled: &peer.Meta.Flags.LazyConnectionEnabled,
+				RosenpassEnabled:      &peer.Meta.Flags.RosenpassEnabled,
+				RosenpassPermissive:   &peer.Meta.Flags.RosenpassPermissive,
+				ServerSshAllowed:      &peer.Meta.Flags.ServerSSHAllowed,
+				RemoteJobsAllowed:     &peer.Meta.Flags.RemoteJobsAllowed,
+			},
+		},
+	}
+}
+
+func fqdn(peer *nbpeer.Peer, dnsDomain string) string {
+	fqdn := peer.FQDN(dnsDomain)
+	if fqdn == "" {
+		return peer.DNSLabel
+	} else {
+		return fqdn
+	}
+}
+func fqdnList(extraLabels []string, dnsDomain string) []string {
+	fqdnList := make([]string, 0, len(extraLabels))
+	for _, label := range extraLabels {
+		fqdn := fmt.Sprintf("%s.%s", label, dnsDomain)
+		fqdnList = append(fqdnList, fqdn)
+	}
+	return fqdnList
+}
+
+func peerIPv6String(peer *nbpeer.Peer) *string {
+	if !peer.IPv6.IsValid() {
+		return nil
+	}
+	s := peer.IPv6.String()
+	return &s
+}

management/server/api/v1alpha1/peers/peers_handler_test.go

@@ -0,0 +1,445 @@
+package peers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"go.uber.org/mock/gomock"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/mock_server"
+)
+
+const (
+	testPeerID                = "test_peer"
+	noUpdateChannelTestPeerID = "no-update-channel"
+
+	adminUser   = "admin_user"
+	regularUser = "regular_user"
+	serviceUser = "service_user"
+)
+
+func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
+
+	peersMap := make(map[string]*nbpeer.Peer)
+	for _, peer := range peers {
+		peersMap[peer.ID] = peer.Copy()
+	}
+
+	policy := &types.Policy{
+		ID:        "policy",
+		AccountID: "test_id",
+		Name:      "policy",
+		Enabled:   true,
+		Rules: []*types.PolicyRule{
+			{
+				ID:            "rule",
+				Name:          "rule",
+				Enabled:       true,
+				Action:        "accept",
+				Destinations:  []string{"group1"},
+				Sources:       []string{"group1"},
+				Bidirectional: true,
+				Protocol:      "all",
+				Ports:         []string{"80"},
+			},
+		},
+	}
+
+	srvUser := types.NewRegularUser(serviceUser, "", "")
+	srvUser.IsServiceUser = true
+
+	account := &types.Account{
+		Id:     "test_id",
+		Domain: "hotmail.com",
+		Peers:  peersMap,
+		Users: map[string]*types.User{
+			adminUser:   types.NewAdminUser(adminUser),
+			regularUser: types.NewRegularUser(regularUser, "", ""),
+			serviceUser: srvUser,
+		},
+		Groups: map[string]*types.Group{
+			"group1": {
+				ID:        "group1",
+				AccountID: "test_id",
+				Name:      "group1",
+				Issued:    "api",
+				Peers:     maps.Keys(peersMap),
+			},
+		},
+		Settings: &types.Settings{
+			PeerLoginExpirationEnabled: true,
+			PeerLoginExpiration:        time.Hour,
+		},
+		Policies: []*types.Policy{policy},
+		Network: &types.Network{
+			Identifier: "ciclqisab2ss43jdn8q0",
+			Net: net.IPNet{
+				IP:   net.ParseIP("100.67.0.0"),
+				Mask: net.IPv4Mask(255, 255, 0, 0),
+			},
+			Serial: 51,
+		},
+	}
+
+	ctrl := gomock.NewController(t)
+
+	networkMapController := network_map.NewMockController(ctrl)
+	networkMapController.EXPECT().
+		GetDNSDomain(gomock.Any()).
+		Return("domain").
+		AnyTimes()
+
+	ctrl2 := gomock.NewController(t)
+	permissionsManager := permissions.NewMockManager(ctrl2)
+	permissionsManager.EXPECT().ValidateAccountAccess(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(context.Background(), nil).AnyTimes()
+	permissionsManager.EXPECT().
+		ValidateUserPermissions(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Eq(modules.Peers), gomock.Eq(operations.Read)).
+		DoAndReturn(func(ctx context.Context, accountID, userID string, module modules.Module, operation operations.Operation) (bool, context.Context, error) {
+			user, ok := account.Users[userID]
+			if !ok {
+				return false, ctx, fmt.Errorf("user not found")
+			}
+			return user.HasAdminPower() || user.IsServiceUser, ctx, nil
+		}).
+		AnyTimes()
+
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			UpdatePeerFunc: func(_ context.Context, accountID, userID string, update *nbpeer.Peer) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if update.ID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				p.SSHEnabled = update.SSHEnabled
+				p.LoginExpirationEnabled = update.LoginExpirationEnabled
+				p.Name = update.Name
+				return p, nil
+			},
+			UpdatePeerIPFunc: func(_ context.Context, accountID, userID, peerID string, newIP netip.Addr) error {
+				for _, peer := range peers {
+					if peer.ID == peerID {
+						peer.IP = newIP
+						return nil
+					}
+				}
+				return fmt.Errorf("peer not found")
+			},
+			GetPeerFunc: func(_ context.Context, accountID, peerID, userID string) (*nbpeer.Peer, error) {
+				var p *nbpeer.Peer
+				for _, peer := range peers {
+					if peerID == peer.ID {
+						p = peer.Copy()
+						break
+					}
+				}
+				return p, nil
+			},
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				switch id {
+				case adminUser:
+					return account.Users[adminUser], nil
+				case regularUser:
+					return account.Users[regularUser], nil
+				case serviceUser:
+					return account.Users[serviceUser], nil
+				default:
+					return nil, fmt.Errorf("user not found")
+				}
+			},
+			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
+				return peers, nil
+			},
+			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
+				peersID := make([]string, len(peers))
+				for _, peer := range peers {
+					peersID = append(peersID, peer.ID)
+				}
+				return []*types.Group{
+					{
+						ID:        "group1",
+						AccountID: accountID,
+						Name:      "group1",
+						Issued:    "api",
+						Peers:     peersID,
+					},
+				}, nil
+			},
+			GetDNSDomainFunc: func(settings *types.Settings) string {
+				return "netbird.selfhosted"
+			},
+			GetAccountFunc: func(ctx context.Context, accountID string) (*types.Account, error) {
+				return account, nil
+			},
+			GetAccountByIDFunc: func(ctx context.Context, accountID string, userID string) (*types.Account, error) {
+				return account, nil
+			},
+			HasConnectedChannelFunc: func(peerID string) bool {
+				statuses := make(map[string]struct{})
+				for _, peer := range peers {
+					if peer.ID == noUpdateChannelTestPeerID {
+						break
+					}
+					statuses[peer.ID] = struct{}{}
+				}
+				_, ok := statuses[peerID]
+				return ok
+			},
+			GetAccountSettingsFunc: func(ctx context.Context, accountID string, userID string) (*types.Settings, error) {
+				return account.Settings, nil
+			},
+		},
+		networkMapController: networkMapController,
+		permissionsManager:   permissionsManager,
+	}
+}
+
+// Tests the GetAllPeers endpoint reachable in the route /api/peers
+// Use the metadata generated by initTestMetaData() to check for values
+func TestGetPeers(t *testing.T) {
+
+	peer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: true},
+		Name:                   "PeerName",
+		LoginExpirationEnabled: false,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname:           "hostname",
+			GoOS:               "GoOS",
+			Kernel:             "kernel",
+			Core:               "core",
+			Platform:           "platform",
+			OS:                 "OS",
+			WtVersion:          "development",
+			SystemSerialNumber: "C02XJ0J0JGH7",
+		},
+	}
+
+	peer1 := peer.Copy()
+	peer1.ID = noUpdateChannelTestPeerID
+
+	expectedUpdatedPeer := peer.Copy()
+	expectedUpdatedPeer.LoginExpirationEnabled = true
+	expectedUpdatedPeer.SSHEnabled = true
+	expectedUpdatedPeer.Name = "New Name"
+
+	expectedPeer1 := peer1.Copy()
+	expectedPeer1.Status.Connected = false
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		contentType    string
+		requestBody    io.Reader
+		expectedArray  bool
+		expectedPeer   *nbpeer.Peer
+	}{
+		{
+			name:           "GetPeersMetaData",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers",
+			expectedStatus: http.StatusOK,
+			expectedArray:  true,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "GetPeer with update channel",
+			requestType:    http.MethodGet,
+			requestPath:    "/peers/" + testPeerID,
+			expectedStatus: http.StatusOK,
+			expectedArray:  false,
+			expectedPeer:   peer,
+		},
+		{
+			name:           "PutPeer",
+			requestType:    http.MethodPut,
+			requestPath:    "/peers/" + testPeerID,
+			contentType:    "application/json",
+			expectedStatus: http.StatusOK,
+			expectedArray:  false,
+			requestBody:    bytes.NewBufferString("{\"login_expiration_enabled\":true,\"name\":\"New Name\",\"ssh_enabled\":true, \"inactivity_expiration_enabled\":true}"),
+			expectedPeer:   expectedUpdatedPeer,
+		},
+	}
+
+	p := initTestMetaData(t, peer, peer1)
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    "admin_user",
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			var got *apiv1alpha1.Peer
+			if tc.expectedArray {
+				respBody := []*apiv1alpha1.Peer{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("Sent content is not in correct json format; %v", err)
+				}
+
+				// hardcode this check for now as we only have two peers in this suite
+				assert.Equal(t, len(respBody), 2)
+
+				for _, peer := range respBody {
+					if peer.Id == testPeerID {
+						got = peer
+					}
+				}
+
+			} else {
+				got = &apiv1alpha1.Peer{}
+				err = json.Unmarshal(content, got)
+				if err != nil {
+					t.Fatalf("Sent content is not in correct json format; %v", err)
+				}
+			}
+
+			t.Log(got)
+
+			assert.Equal(t, tc.expectedPeer.Name, got.Name)
+			assert.Equal(t, tc.expectedPeer.Meta.WtVersion, got.Version)
+			assert.Equal(t, tc.expectedPeer.IP.String(), got.Ip)
+			assert.Equal(t, "OS core", got.Os)
+			assert.Equal(t, tc.expectedPeer.LoginExpirationEnabled, got.LoginExpirationEnabled)
+			assert.Equal(t, tc.expectedPeer.SSHEnabled, got.SshEnabled)
+			assert.Equal(t, tc.expectedPeer.Status.Connected, got.Connected)
+			assert.Equal(t, tc.expectedPeer.Meta.SystemSerialNumber, got.SerialNumber)
+		})
+	}
+}
+
+func TestPeersHandlerUpdatePeerIP(t *testing.T) {
+	testPeer := &nbpeer.Peer{
+		ID:                     testPeerID,
+		Key:                    "key",
+		IP:                     netip.MustParseAddr("100.64.0.1"),
+		IPv6:                   netip.MustParseAddr("fd00::1"),
+		Status:                 &nbpeer.PeerStatus{Connected: false, LastSeen: time.Now()},
+		Name:                   "test-host@netbird.io",
+		LoginExpirationEnabled: false,
+		UserID:                 regularUser,
+		Meta: nbpeer.PeerSystemMeta{
+			Hostname: "test-host@netbird.io",
+			Core:     "22.04",
+		},
+	}
+
+	p := initTestMetaData(t, testPeer)
+
+	tt := []struct {
+		name           string
+		peerID         string
+		requestBody    string
+		callerUserID   string
+		expectedStatus int
+		expectedIP     string
+	}{
+		{
+			name:           "update peer IP successfully",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "100.64.0.100"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusOK,
+			expectedIP:     "100.64.0.100",
+		},
+		{
+			name:           "update peer IP with invalid IP",
+			peerID:         testPeerID,
+			requestBody:    `{"name":"test", "ssh_enabled":true, "login_expiration_enabled":true, "inactivity_expiration_enabled":true, "ip": "invalid-ip"}`,
+			callerUserID:   adminUser,
+			expectedStatus: http.StatusUnprocessableEntity,
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPut, fmt.Sprintf("/peers/%s", tc.peerID), bytes.NewBuffer([]byte(tc.requestBody)))
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    tc.callerUserID,
+				Domain:    "hotmail.com",
+				AccountId: "test_id",
+			})
+
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = p.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			assert.Equal(t, tc.expectedStatus, rr.Code)
+
+			if tc.expectedStatus == http.StatusOK && tc.expectedIP != "" {
+				var updatedPeer apiv1alpha1.Peer
+				err := json.Unmarshal(rr.Body.Bytes(), &updatedPeer)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedIP, updatedPeer.Ip)
+			}
+		})
+	}
+}

management/server/api/v1alpha1/users/users_handler.go

@@ -0,0 +1,275 @@
+package users
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"github.com/gorilla/mux"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+)
+
+type Handler struct {
+	accountManager account.Manager
+}
+
+func NewHandler(accountManager account.Manager) *Handler {
+	return &Handler{
+		accountManager: accountManager,
+	}
+}
+
+func (h *Handler) WithEndpointsForRouter(router *mux.Router) *mux.Router {
+	router.HandleFunc("/users", h.getAllUsers).Methods("GET", "OPTIONS")
+	router.HandleFunc("/users", h.createUser).Methods("POST", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.updateUser).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/users/{userId}", h.deleteUser).Methods("DELETE", "OPTIONS")
+	return router
+}
+
+// updateUser is a PUT requests to update User data
+func (h *Handler) updateUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	existingUser, err := h.accountManager.GetUserByID(r.Context(), targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	req := &apiv1alpha1.UserRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if req.AutoGroups == nil {
+		util.WriteErrorResponse("auto_groups field can't be absent", http.StatusBadRequest, w)
+		return
+	}
+
+	userRole := types.StrRoleToUserRole(req.Role)
+	if userRole == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user role"), w)
+		return
+	}
+
+	newUser, err := h.accountManager.SaveUser(r.Context(), accountID, userID, &types.User{
+		Id:                   targetUserID,
+		Role:                 userRole,
+		AutoGroups:           req.AutoGroups,
+		Blocked:              req.IsBlocked,
+		Issued:               existingUser.Issued,
+		IntegrationReference: existingUser.IntegrationReference,
+	})
+
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// deleteUser is a DELETE request to delete a user
+func (h *Handler) deleteUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	vars := mux.Vars(r)
+	targetUserID := vars["userId"]
+	if len(targetUserID) == 0 {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid user ID"), w)
+		return
+	}
+
+	err = h.accountManager.DeleteUser(r.Context(), accountID, userID, targetUserID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+// createUser creates a User in the system with a status "invited" (effectively this is a user invite).
+func (h *Handler) createUser(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+
+	req := &apiv1alpha1.UserCreateRequest{}
+	err = json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if types.StrRoleToUserRole(req.Role) == types.UserRoleUnknown {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "unknown user role %s", req.Role), w)
+		return
+	}
+
+	email := ""
+	if req.Email != nil {
+		email = *req.Email
+	}
+
+	name := ""
+	if req.Name != nil {
+		name = *req.Name
+	}
+
+	newUser, err := h.accountManager.CreateUser(r.Context(), accountID, userID, &types.UserInfo{
+		Email:         email,
+		Name:          name,
+		Role:          req.Role,
+		AutoGroups:    req.AutoGroups,
+		IsServiceUser: req.IsServiceUser,
+		Issued:        types.UserIssuedAPI,
+	})
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, toUserResponse(newUser, userID))
+}
+
+// getAllUsers returns a list of users of the account this user belongs to.
+// It also gathers additional user data (like email and name) from the IDP manager.
+func (h *Handler) getAllUsers(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		util.WriteErrorResponse("wrong HTTP method", http.StatusMethodNotAllowed, w)
+		return
+	}
+
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	accountID, userID := userAuth.AccountId, userAuth.UserId
+	data, err := h.accountManager.GetUsersFromAccount(r.Context(), accountID, userID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	serviceUser := r.URL.Query().Get("service_user")
+
+	users := make([]*apiv1alpha1.User, 0)
+	for _, d := range data {
+		if d.NonDeletable {
+			continue
+		}
+		if serviceUser == "" {
+			users = append(users, toUserResponse(d, userID))
+			continue
+		}
+
+		includeServiceUser, err := strconv.ParseBool(serviceUser)
+		log.WithContext(r.Context()).Tracef("Should include service user: %v", includeServiceUser)
+		if err != nil {
+			util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "invalid service_user query parameter"), w)
+			return
+		}
+		if includeServiceUser == d.IsServiceUser {
+			users = append(users, toUserResponse(d, userID))
+		}
+	}
+
+	util.WriteJSONObject(r.Context(), w, users)
+}
+
+func toUserResponse(user *types.UserInfo, currenUserID string) *apiv1alpha1.User {
+	autoGroups := user.AutoGroups
+	if autoGroups == nil {
+		autoGroups = []string{}
+	}
+
+	var userStatus apiv1alpha1.UserStatus
+	switch user.Status {
+	case "active":
+		userStatus = apiv1alpha1.UserStatusActive
+	case "invited":
+		userStatus = apiv1alpha1.UserStatusInvited
+	default:
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	if user.IsBlocked {
+		userStatus = apiv1alpha1.UserStatusBlocked
+	}
+
+	isCurrent := user.ID == currenUserID
+
+	var password *string
+	if user.Password != "" {
+		password = &user.Password
+	}
+
+	var idpID *string
+	if user.IdPID != "" {
+		idpID = &user.IdPID
+	}
+
+	return &apiv1alpha1.User{
+		Id:              user.ID,
+		Name:            user.Name,
+		Email:           user.Email,
+		Role:            user.Role,
+		AutoGroups:      autoGroups,
+		Status:          userStatus,
+		IsCurrent:       &isCurrent,
+		IsServiceUser:   &user.IsServiceUser,
+		IsBlocked:       user.IsBlocked,
+		LastLogin:       &user.LastLogin,
+		Issued:          &user.Issued,
+		PendingApproval: user.PendingApproval,
+		Password:        password,
+		IdpId:           idpID,
+	}
+}

management/server/api/v1alpha1/users/users_handler_test.go

@@ -0,0 +1,452 @@
+package users
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/management/server/mock_server"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/apiv1alpha1"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	existingAccountID         = "existingAccountID"
+	notFoundAccountID         = "notFoundAccountID"
+	testDomain                = "hotmail.com"
+	existingUserID            = "existingUserID"
+	notFoundUserID            = "notFoundUserID"
+	serviceUserID             = "serviceUserID"
+	nonDeletableServiceUserID = "nonDeletableServiceUserID"
+	regularUserID             = "regularUserID"
+)
+
+var usersTestAccount = &types.Account{
+	Id:     existingAccountID,
+	Domain: testDomain,
+	Users: map[string]*types.User{
+		existingUserID: {
+			Id:            existingUserID,
+			Role:          "admin",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		regularUserID: {
+			Id:            regularUserID,
+			Role:          "user",
+			IsServiceUser: false,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		serviceUserID: {
+			Id:            serviceUserID,
+			Role:          "user",
+			IsServiceUser: true,
+			AutoGroups:    []string{"group_1"},
+			Issued:        types.UserIssuedAPI,
+		},
+		nonDeletableServiceUserID: {
+			Id:            nonDeletableServiceUserID,
+			Role:          "admin",
+			IsServiceUser: true,
+			NonDeletable:  true,
+			Issued:        types.UserIssuedIntegration,
+		},
+	},
+}
+
+func initUsersTestData() *Handler {
+	return &Handler{
+		accountManager: &mock_server.MockAccountManager{
+			GetUserByIDFunc: func(ctx context.Context, id string) (*types.User, error) {
+				return usersTestAccount.Users[id], nil
+			},
+			GetUsersFromAccountFunc: func(_ context.Context, accountID, userID string) (map[string]*types.UserInfo, error) {
+				usersInfos := make(map[string]*types.UserInfo)
+				for _, v := range usersTestAccount.Users {
+					usersInfos[v.Id] = &types.UserInfo{
+						ID:            v.Id,
+						Role:          string(v.Role),
+						Name:          "",
+						Email:         "",
+						IsServiceUser: v.IsServiceUser,
+						NonDeletable:  v.NonDeletable,
+						Issued:        v.Issued,
+					}
+				}
+				return usersInfos, nil
+			},
+			CreateUserFunc: func(_ context.Context, accountID, userID string, key *types.UserInfo) (*types.UserInfo, error) {
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+				return key, nil
+			},
+			DeleteUserFunc: func(_ context.Context, accountID string, initiatorUserID string, targetUserID string) error {
+				if targetUserID == notFoundUserID {
+					return status.Errorf(status.NotFound, "user with ID %s does not exists", targetUserID)
+				}
+				if !usersTestAccount.Users[targetUserID].IsServiceUser {
+					return status.Errorf(status.PermissionDenied, "user with ID %s is not a service user and can not be deleted", targetUserID)
+				}
+				return nil
+			},
+			SaveUserFunc: func(_ context.Context, accountID, userID string, update *types.User) (*types.UserInfo, error) {
+				if update.Id == notFoundUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", update.Id)
+				}
+
+				if userID != existingUserID {
+					return nil, status.Errorf(status.NotFound, "user with ID %s does not exists", userID)
+				}
+
+				info, err := update.Copy().ToUserInfo(nil)
+				if err != nil {
+					return nil, err
+				}
+				return info, nil
+			},
+		},
+	}
+}
+
+func TestGetUsers(t *testing.T) {
+	tt := []struct {
+		name            string
+		expectedStatus  int
+		requestType     string
+		requestPath     string
+		expectedUserIDs []string
+	}{
+		{name: "getAllUsers", requestType: http.MethodGet, requestPath: "/users", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID, serviceUserID}},
+		{name: "GetOnlyServiceUsers", requestType: http.MethodGet, requestPath: "/users?service_user=true", expectedStatus: http.StatusOK, expectedUserIDs: []string{serviceUserID}},
+		{name: "GetOnlyRegularUsers", requestType: http.MethodGet, requestPath: "/users?service_user=false", expectedStatus: http.StatusOK, expectedUserIDs: []string{existingUserID, regularUserID}},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			content, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Fatalf("I don't know what I expected; %v", err)
+			}
+
+			if status := recorder.Code; status != tc.expectedStatus {
+				t.Errorf("handler returned wrong status code: got %v want %v, content: %s",
+					status, tc.expectedStatus, string(content))
+				return
+			}
+
+			respBody := []*types.UserInfo{}
+			err = json.Unmarshal(content, &respBody)
+			if err != nil {
+				t.Fatalf("Sent content is not in correct json format; %v", err)
+			}
+
+			assert.Equal(t, len(respBody), len(tc.expectedUserIDs))
+			for _, v := range respBody {
+				assert.Contains(t, tc.expectedUserIDs, v.ID)
+				assert.Equal(t, v.ID, usersTestAccount.Users[v.ID].Id)
+				assert.Equal(t, v.Role, string(usersTestAccount.Users[v.ID].Role))
+				assert.Equal(t, v.IsServiceUser, usersTestAccount.Users[v.ID].IsServiceUser)
+				assert.Equal(t, v.Issued, usersTestAccount.Users[v.ID].Issued)
+			}
+		})
+	}
+}
+
+func TestUpdateUser(t *testing.T) {
+	tt := []struct {
+		name                  string
+		expectedStatusCode    int
+		requestType           string
+		requestPath           string
+		requestBody           io.Reader
+		expectedUserID        string
+		expectedRole          string
+		expectedStatus        string
+		expectedBlocked       bool
+		expectedIsServiceUser bool
+		expectedGroups        []string
+	}{
+		{
+			name:               "Update_Block_User",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    true,
+			expectedRole:       "user",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"user\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": true}"),
+		},
+		{
+			name:               "Update_Change_Role_To_Admin",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_1"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_1\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Update_Groups",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusOK,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"auto_groups\":[\"group_3\", \"group_2\"],\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+		{
+			name:               "Should_Fail_Because_AutoGroups_Is_Absent",
+			requestType:        http.MethodPut,
+			requestPath:        "/users/" + regularUserID,
+			expectedStatusCode: http.StatusUnprocessableEntity,
+			expectedUserID:     regularUserID,
+			expectedBlocked:    false,
+			expectedRole:       "admin",
+			expectedStatus:     "blocked",
+			expectedGroups:     []string{"group_2", "group_3"},
+			requestBody:        bytes.NewBufferString("{\"role\":\"admin\",\"is_service_user\":false, \"is_blocked\": false}"),
+		},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			req.Header.Set("Content-Type", "application/json")
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(recorder, req)
+
+			res := recorder.Result()
+			defer res.Body.Close()
+
+			if status := recorder.Code; status != tc.expectedStatusCode {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, http.StatusOK)
+			}
+
+			if tc.expectedStatusCode == 200 {
+
+				content, err := io.ReadAll(res.Body)
+				if err != nil {
+					t.Fatalf("I don't know what I expected; %v", err)
+				}
+
+				respBody := &apiv1alpha1.User{}
+				err = json.Unmarshal(content, &respBody)
+				if err != nil {
+					t.Fatalf("response content is not in correct json format; %v", err)
+				}
+
+				assert.Equal(t, tc.expectedUserID, respBody.Id)
+				assert.Equal(t, tc.expectedRole, respBody.Role)
+				assert.Equal(t, tc.expectedIsServiceUser, *respBody.IsServiceUser)
+				assert.Equal(t, tc.expectedBlocked, respBody.IsBlocked)
+				assert.Len(t, respBody.AutoGroups, len(tc.expectedGroups))
+
+				for _, expectedGroup := range tc.expectedGroups {
+					exists := false
+					for _, actualGroup := range respBody.AutoGroups {
+						if expectedGroup == actualGroup {
+							exists = true
+						}
+					}
+					assert.True(t, exists, fmt.Sprintf("group %s not found in the response", expectedGroup))
+				}
+			}
+		})
+	}
+}
+
+func TestCreateUser(t *testing.T) {
+	name := "name"
+	email := "email"
+	serviceUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         nil,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	serviceUserString, err := json.Marshal(serviceUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	regularUserToAdd := apiv1alpha1.UserCreateRequest{
+		AutoGroups:    []string{},
+		Email:         &email,
+		IsServiceUser: true,
+		Name:          &name,
+		Role:          "admin",
+	}
+	regularUserString, err := json.Marshal(regularUserToAdd)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tt := []struct {
+		name           string
+		expectedStatus int
+		requestType    string
+		requestPath    string
+		requestBody    io.Reader
+		expectedResult []*types.User
+	}{
+		{name: "CreateServiceUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(serviceUserString)},
+		// right now creation is blocked in AC middleware, will be refactored in the future
+		{name: "CreateRegularUser", requestType: http.MethodPost, requestPath: "/users", expectedStatus: http.StatusOK, requestBody: bytes.NewBuffer(regularUserString)},
+	}
+
+	userHandler := initUsersTestData()
+
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, tc.requestBody)
+			rr := httptest.NewRecorder()
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			req.Header.Set("Content-Type", "application/json")
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}
+
+func TestDeleteUser(t *testing.T) {
+	tt := []struct {
+		name           string
+		expectedStatus int
+		expectedBody   bool
+		requestType    string
+		requestPath    string
+		requestVars    map[string]string
+		requestBody    io.Reader
+	}{
+		{
+			name:           "Delete Regular User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + regularUserID,
+			requestVars:    map[string]string{"userId": regularUserID},
+			expectedStatus: http.StatusForbidden,
+		},
+		{
+			name:           "Delete Service User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + serviceUserID,
+			requestVars:    map[string]string{"userId": serviceUserID},
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "Delete Not Existing User",
+			requestType:    http.MethodDelete,
+			requestPath:    "/users/" + notFoundUserID,
+			requestVars:    map[string]string{"userId": notFoundUserID},
+			expectedStatus: http.StatusNotFound,
+		},
+	}
+
+	userHandler := initUsersTestData()
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.requestType, tc.requestPath, nil)
+			req = mux.SetURLVars(req, tc.requestVars)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+				UserId:    existingUserID,
+				Domain:    testDomain,
+				AccountId: existingAccountID,
+			})
+			rr := httptest.NewRecorder()
+
+			v1validator, err := apiv1alpha1.CreateV1ApiValidatingMiddleware()
+			assert.NoError(t, err)
+
+			router := mux.NewRouter()
+			router.Use(v1validator.Handler)
+			router = userHandler.WithEndpointsForRouter(router)
+			router.ServeHTTP(rr, req)
+
+			res := rr.Result()
+			defer res.Body.Close()
+
+			if status := rr.Code; status != tc.expectedStatus {
+				t.Fatalf("handler returned wrong status code: got %v want %v",
+					status, tc.expectedStatus)
+			}
+		})
+	}
+}

management/server/auth/session.go

@@ -3,9 +3,11 @@ package auth
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 )
 
@@ -52,6 +54,22 @@ func (s *SessionStore) RegisterToken(ctx context.Context, token string, expiresA
 }
 
 func hashToken(token string) string {
-	sum := sha256.Sum256([]byte(token))
+	sum := sha256.Sum256([]byte(canonicalizeToken(token)))
 	return hex.EncodeToString(sum[:])
 }
+
+// canonicalizeToken re-encodes the JWT signature segment so noncanonical
+// spellings of the same signature map to one stable cache key.
+func canonicalizeToken(token string) string {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return token
+	}
+
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return token
+	}
+
+	return parts[0] + "." + parts[1] + "." + base64.RawURLEncoding.EncodeToString(sig)
+}

management/server/auth/session_test.go

@@ -2,10 +2,15 @@ package auth
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
 	"errors"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -131,3 +136,49 @@ func TestHashToken_StableAndDoesNotLeak(t *testing.T) {
 	assert.Len(t, a, 64, "sha256 hex must be 64 chars")
 	assert.NotContains(t, a, "tokenA", "raw token must not appear in hash")
 }
+
+func TestSessionStore_NoncanonicalSpellingIsRejectedAsReplay(t *testing.T) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
+		"sub": "user",
+		"exp": time.Now().Add(time.Hour).Unix(),
+	})
+	canonical, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	parts := strings.Split(canonical, ".")
+	require.Len(t, parts, 3)
+
+	// A 256-byte RSA signature (256 mod 3 == 1) leaves unused bits in the final
+	// base64url character; flip one without changing the decoded signature.
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+	last := strings.IndexByte(alphabet, parts[2][len(parts[2])-1])
+	require.GreaterOrEqual(t, last, 0)
+	require.Equal(t, 0, last&3, "unexpected canonical RSA signature encoding")
+
+	equivalentSig := parts[2][:len(parts[2])-1] + string(alphabet[last|1])
+	equivalent := parts[0] + "." + parts[1] + "." + equivalentSig
+	require.NotEqual(t, canonical, equivalent, "spellings must differ as strings")
+
+	// Same decoded signature bytes, so they verify as the same JWT.
+	canonicalSig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	require.NoError(t, err)
+	altSig, err := base64.RawURLEncoding.DecodeString(equivalentSig)
+	require.NoError(t, err)
+	require.Equal(t, canonicalSig, altSig, "spellings must decode to identical signature bytes")
+
+	// The replay-cache key must be identical for both spellings.
+	assert.Equal(t, hashToken(canonical), hashToken(equivalent),
+		"noncanonical spelling must map to the same replay-cache key")
+
+	s := newTestSessionStore(t)
+	ctx := context.Background()
+	exp := time.Now().Add(time.Hour)
+
+	require.NoError(t, s.RegisterToken(ctx, canonical, exp), "first claim should succeed")
+	err = s.RegisterToken(ctx, equivalent, exp)
+	require.Error(t, err, "alternate spelling must be treated as a replay")
+	assert.ErrorIs(t, err, ErrTokenAlreadyUsed)
+}

management/server/cache/idp.go

@@ -88,7 +88,8 @@ func NewUserDataCache(store store.StoreInterface) *UserDataCacheImpl {
 
 // AccountUserDataCache wraps the basic Get, Set and Delete methods for []*idp.UserData objects.
 type AccountUserDataCache struct {
-	cache Marshaler
+	cache    Marshaler
+	loadable *cache.LoadableCache[any]
 }
 
 func (a *AccountUserDataCache) Get(ctx context.Context, key string) ([]*idp.UserData, error) {
@@ -127,13 +128,18 @@ func (a *AccountUserDataCache) Delete(ctx context.Context, key string) error {
 	return a.cache.Delete(ctx, key)
 }
 
+// Close stops the goroutine that stores loaded values. The cache must not be used afterwards.
+func (a *AccountUserDataCache) Close() error {
+	return a.loadable.Close()
+}
+
 // NewAccountUserDataCache creates a new AccountUserDataCache object.
 func NewAccountUserDataCache(loadableFunc cache.LoadFunction[any], store store.StoreInterface) *AccountUserDataCache {
 	simpleCache := cache.New[any](store)
 	loadable := cache.NewLoadable[any](loadableFunc, simpleCache)
 	if store.GetType() == redis.RedisType {
 		m := marshaler.New(loadable)
-		return &AccountUserDataCache{cache: m}
+		return &AccountUserDataCache{cache: m, loadable: loadable}
 	}
-	return &AccountUserDataCache{cache: &marshalerWraper{loadable}}
+	return &AccountUserDataCache{cache: &marshalerWraper{loadable}, loadable: loadable}
 }

management/server/dns_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -16,7 +16,6 @@ import (
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -234,9 +233,9 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createDNSStore(t *testing.T) (store.Store, error) {
@@ -363,163 +362,167 @@ func initTestDNSAccount(t *testing.T, am *DefaultAccountManager) (*types.Account
 }
 
 func TestDNSAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
-	t.Run("saving dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+		err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
 		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have no peers should not update account peers or send peer update
-	t.Run("creating dns setting with unused groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Creating DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("creating dns setting with used groups", func(t *testing.T) {
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates
+		step(t, "saving dns setting with unused groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr(peer1.IP.String()),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
 
-	// Saving DNS settings with groups that have peers should update account peers and send peer update
-	t.Run("saving dns setting with used groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA", "groupB"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have no peers should not update account peers or send peer update
+		step(t, "creating dns setting with unused groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
-	t.Run("removing group with no peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupA"},
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Creating DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "creating dns setting with used groups", func(t *testing.T) {
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
 
-	// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
-	t.Run("removing group with peers from dns settings", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{},
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr(peer1.IP.String()),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Saving DNS settings with groups that have peers should update account peers and send peer update
+		step(t, "saving dns setting with used groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA", "groupB"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing group with no peers from DNS settings  should not trigger updates to account peers or send peer updates
+		step(t, "removing group with no peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupA"},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing group with peers from DNS settings should trigger updates to account peers and send peer updates
+		step(t, "removing group with peers from dns settings", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }

management/server/group.go

@@ -166,9 +166,11 @@ func (am *DefaultAccountManager) UpdateGroup(ctx context.Context, accountID, use
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		// A membership change does not alter which entities reference the group, so
 		// the dependency walk runs once against the post-change snapshot. The new
@@ -321,7 +323,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	var globalErr error
 	for _, newGroup := range groups {
 		change := affectedpeers.Change{ChangedGroupIDs: []string{newGroup.ID}}
-		events, snap, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
+		events, snap, change, err := am.updateSingleGroup(ctx, accountID, userID, newGroup, change)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to update group %s: %v", newGroup.ID, err)
 			if len(groups) == 1 {
@@ -344,7 +346,7 @@ func (am *DefaultAccountManager) UpdateGroups(ctx context.Context, accountID, us
 	return globalErr
 }
 
-func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, error) {
+func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, change affectedpeers.Change) ([]func(), *affectedpeers.Snapshot, affectedpeers.Change, error) {
 	var events []func()
 	var snap *affectedpeers.Snapshot
 	err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
@@ -364,9 +366,11 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{newGroup.ID})
+		if err != nil {
 			return err
 		}
+		change.ChangedPeerIDs = ipv6Changed
 
 		if err := transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
 			return err
@@ -377,7 +381,7 @@ func (am *DefaultAccountManager) updateSingleGroup(ctx context.Context, accountI
 		snap, err = affectedpeers.Load(ctx, transaction, accountID, change)
 		return err
 	})
-	return events, snap, err
+	return events, snap, change, err
 }
 
 // prepareGroupEvents prepares a list of event functions to be stored.
@@ -480,8 +484,8 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 	var allErrors error
 	var groupIDsToDelete []string
 	var deletedGroups []*types.Group
-	var snap *affectedpeers.Snapshot
-	var change affectedpeers.Change
+	var snap, ipv6Snap *affectedpeers.Snapshot
+	var change, ipv6Change affectedpeers.Change
 
 	extraSettings, err := am.settingsManager.GetExtraSettings(ctx, accountID)
 	if err != nil {
@@ -510,10 +514,20 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 			return err
 		}
 
-		if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, groupIDsToDelete)
+		if err != nil {
 			return err
 		}
 
+		// Members of a deleted IPv6-enabled group lose their address, which the
+		// pre-delete snapshot cannot see, so they are resolved post-delete.
+		if len(ipv6Changed) > 0 {
+			ipv6Change = affectedpeers.Change{ChangedPeerIDs: ipv6Changed}
+			if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
+				return err
+			}
+		}
+
 		return transaction.IncrementNetworkSerial(ctx, accountID)
 	})
 	if err != nil {
@@ -524,7 +538,7 @@ func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, us
 		am.StoreEvent(ctx, userID, group.ID, accountID, activity.GroupDeleted, group.EventMeta())
 	}
 
-	am.ExpandAndUpdateAffected(ctx, accountID, snap, change)
+	go am.dispatchAffected(ctx, accountID, []*affectedpeers.Snapshot{snap, ipv6Snap}, []affectedpeers.Change{change, ipv6Change})
 
 	return allErrors
 }
@@ -564,11 +578,14 @@ func (am *DefaultAccountManager) GroupAddPeer(ctx context.Context, accountID, gr
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}
@@ -634,11 +651,14 @@ func (am *DefaultAccountManager) GroupDeletePeer(ctx context.Context, accountID,
 			return err
 		}
 
-		if err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID}); err != nil {
+		ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, []string{groupID})
+		if err != nil {
 			return err
 		}
+		// A peer whose IPv6 address changed is visible to every peer that reaches it
+		// through any of its groups, not only through this one.
+		change.ChangedPeerIDs = ipv6Changed
 
-		var err error
 		if snap, err = affectedpeers.Load(ctx, transaction, accountID, change); err != nil {
 			return err
 		}

management/server/group_test.go

@@ -23,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -685,342 +686,368 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 }
 
 func TestGroupAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Saving a group that is not linked to any resource should not update account peers
-	t.Run("saving unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding a peer to a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Removing a peer from a group that is not linked to any resource should not update account peers
-	// and not send peer update
-	t.Run("removing peer from unliked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting group should not update account peers and not send peer update
-	t.Run("deleting group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// adding a group to policy
-	_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID},
 			},
-		},
-	}, true)
-	assert.NoError(t, err)
-
-	// Saving a group linked to policy should update account peers and send peer update
-	t.Run("saving linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID},
-		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// adding peer to a used group should update account peers and send peer update
-	t.Run("adding peer to linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// removing peer from a linked group should update account peers and send peer update
-	t.Run("removing peer from linked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+		// Saving a group that is not linked to any resource should not update account peers
+		step(t, "saving unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding a peer to a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Removing a peer from a group that is not linked to any resource should not update account peers
+		// and not send peer update
+		step(t, "removing peer from unliked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting group should not update account peers and not send peer update
+		step(t, "deleting group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB")
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// adding a group to policy
+		_, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"groupA"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
+		}, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to policy should update account peers and send peer update
+		step(t, "saving linked group to policy", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-	// Saving a group linked to name server group should update account peers and send peer update
-	t.Run("saving group linked to name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, nil, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID},
+			})
+			assert.NoError(t, err)
 
-		err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// adding peer to a used group should update account peers and send peer update
+		step(t, "adding peer to linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to route should update account peers and send peer update
-	t.Run("saving group linked to route", func(t *testing.T) {
-		newRoute := route.Route{
-			ID:          "route",
-			Network:     netip.MustParsePrefix("192.168.0.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// removing peer from a linked group should update account peers and send peer update
+		step(t, "removing peer from linked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Saving a group linked to dns settings should update account peers and send peer update
-	t.Run("saving group linked to dns settings", func(t *testing.T) {
-		err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
-			DisabledManagementGroups: []string{"groupD"},
+			err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to name server group should update account peers and send peer update
+		step(t, "saving group linked to name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, nil, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID},
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Saving a group linked to route should update account peers and send peer update
+		step(t, "saving group linked to route", func(t *testing.T) {
+			newRoute := route.Route{
+				ID:          "route",
+				Network:     netip.MustParsePrefix("192.168.0.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
 
-	// Saving a group linked to network router should update account peers and send peer update
-	t.Run("saving group linked to network router", func(t *testing.T) {
-		permissionsManager := permissions.NewManager(manager.Store)
-		groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
-		resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
-		routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
-		networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
+			settleAffectedUpdates(updMsg)
 
-		network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
-			ID:          "network_test",
-			AccountID:   account.Id,
-			Name:        "network_test",
-			Description: "",
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
-			ID:         "router_test",
-			NetworkID:  network.ID,
-			AccountID:  account.Id,
-			PeerGroups: []string{"groupE"},
-			Masquerade: true,
-			Metric:     9999,
-			Enabled:    true,
+		// Saving a group linked to dns settings should update account peers and send peer update
+		step(t, "saving group linked to dns settings", func(t *testing.T) {
+			err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{
+				DisabledManagementGroups: []string{"groupD"},
+			})
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Saving a group linked to network router should update account peers and send peer update
+		step(t, "saving group linked to network router", func(t *testing.T) {
+			permissionsManager := permissions.NewManager(manager.Store)
+			groupsManager := groups.NewManager(manager.Store, permissionsManager, manager)
+			resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager)
+			routersManager := routers.NewManager(manager.Store, permissionsManager, manager)
+			networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupE",
-			Name:  "GroupE",
-			Peers: []string{peer2.ID, peer3.ID},
+			network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{
+				ID:          "network_test",
+				AccountID:   account.Id,
+				Name:        "network_test",
+				Description: "",
+			})
+			require.NoError(t, err)
+
+			_, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{
+				ID:         "router_test",
+				NetworkID:  network.ID,
+				AccountID:  account.Id,
+				PeerGroups: []string{"groupE"},
+				Masquerade: true,
+				Metric:     9999,
+				Enabled:    true,
+			})
+			require.NoError(t, err)
+
+			resource, err := resourcesManager.CreateResource(context.Background(), userID, &resourceTypes.NetworkResource{
+				AccountID: account.Id,
+				NetworkID: network.ID,
+				Name:      "resource_test",
+				Address:   "10.20.30.0/24",
+				Enabled:   true,
+			})
+			require.NoError(t, err)
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, peerToResourcePolicyByResource("groupA", resource.ID), true)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupE",
+				Name:  "GroupE",
+				Peers: []string{peer2.ID, peer3.ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
 	})
 }
 

management/server/http/handler.go

@@ -7,8 +7,6 @@ import (
 	"net/netip"
 
 	"github.com/gorilla/mux"
-	"github.com/rs/cors"
-	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain/manager"
 
@@ -36,7 +34,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/http/handlers/proxy"
 
-	"github.com/netbirdio/netbird/management/server/auth"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	nbgroups "github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/http/handlers/accounts"
@@ -51,17 +48,20 @@ import (
 	"github.com/netbirdio/netbird/management/server/http/handlers/routes"
 	"github.com/netbirdio/netbird/management/server/http/handlers/setup_keys"
 	"github.com/netbirdio/netbird/management/server/http/handlers/users"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/middleware/bypass"
 	nbinstance "github.com/netbirdio/netbird/management/server/instance"
 	nbnetworks "github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
-	"github.com/netbirdio/netbird/management/server/telemetry"
 )
 
 // NewAPIHandler creates the Management service HTTP API handler registering all the available endpoints.
-func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager, resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation, authManager auth.Manager, appMetrics telemetry.AppMetrics, permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager, networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager, reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer, trustedHTTPProxies []netip.Prefix, rateLimiter *middleware.APIRateLimiter, isValidChildAccount middleware.IsValidChildAccountFunc, agentNetworkManager agentnetwork.Manager) (http.Handler, error) {
+func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager,
+	resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation,
+	permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager,
+	networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager,
+	reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer,
+	trustedHTTPProxies []netip.Prefix, agentNetworkManager agentnetwork.Manager, proxyTokenRevocationGuard proxytoken.RevocationGuard) (http.Handler, error) {
 
 	// Register bypass paths for unauthenticated endpoints
 	if err := bypass.AddBypassPath("/api/instance"); err != nil {
@@ -82,28 +82,6 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		return nil, fmt.Errorf("failed to add bypass path: %w", err)
 	}
 
-	if rateLimiter == nil {
-		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
-		rateLimiter = middleware.NewAPIRateLimiter(nil)
-		rateLimiter.SetEnabled(false)
-	}
-
-	authMiddleware := middleware.NewAuthMiddleware(
-		authManager,
-		accountManager.GetAccountIDFromUserAuth,
-		accountManager.SyncUserJWTGroups,
-		accountManager.GetUserFromUserAuth,
-		rateLimiter,
-		appMetrics.GetMeter(),
-		isValidChildAccount,
-	)
-
-	corsMiddleware := cors.AllowAll()
-
-	metricsMiddleware := appMetrics.HTTPMiddleware()
-
-	router.Use(metricsMiddleware.Handler, corsMiddleware.Handler, authMiddleware.Handler)
-
 	instanceManager, err := nbinstance.NewManager(ctx, accountManager.GetStore(), idpManager)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create instance manager: %w", err)
@@ -135,7 +113,7 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		reverseproxymanager.RegisterEndpoints(serviceManager, *reverseProxyDomainManager, reverseProxyAccessLogsManager, permissionsManager, router)
 	}
 
-	proxytoken.RegisterEndpoints(accountManager.GetStore(), permissionsManager, router)
+	proxytoken.RegisterEndpoints(accountManager.GetStore(), permissionsManager, proxyTokenRevocationGuard, router)
 
 	// Register OAuth callback handler for proxy authentication
 	if proxyGRPCServer != nil {

management/server/http/handlers/accounts/accounts_handler.go

@@ -128,7 +128,7 @@ func (h *handler) validateNetworkRange(ctx context.Context, accountID, userID st
 }
 
 func (h *handler) validateCapacity(ctx context.Context, accountID, userID string, prefix netip.Prefix) error {
-	peers, err := h.accountManager.GetPeers(ctx, accountID, userID, "", "")
+	peers, err := h.accountManager.GetPeers(ctx, accountID, userID, "", "", "")
 	if err != nil {
 		return status.Errorf(status.Internal, "get peer count: %v", err)
 	}

management/server/http/handlers/groups/groups_handler.go

@@ -58,7 +58,7 @@ func (h *handler) getAllGroups(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+		accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 		if err != nil {
 			util.WriteError(r.Context(), err, w)
 			return
@@ -77,7 +77,7 @@ func (h *handler) getAllGroups(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -169,7 +169,7 @@ func (h *handler) updateGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -226,7 +226,7 @@ func (h *handler) createGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -287,7 +287,7 @@ func (h *handler) getGroup(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "")
+	accountPeers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, "", "", "")
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return

management/server/http/handlers/groups/groups_handler_test.go

@@ -78,7 +78,7 @@ func initGroupTestData(initGroups ...*types.Group) *handler {
 
 				return nil, status.Errorf(status.NotFound, "unknown group name")
 			},
-			GetPeersFunc: func(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+			GetPeersFunc: func(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 				return maps.Values(TestPeers), nil
 			},
 			DeleteGroupFunc: func(_ context.Context, accountID, userId, groupID string) error {

management/server/http/handlers/peers/peers_handler.go

@@ -317,10 +317,11 @@ func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 
 	nameFilter := r.URL.Query().Get("name")
 	ipFilter := r.URL.Query().Get("ip")
+	macFilter := r.URL.Query().Get("mac")
 
 	accountID, userID := userAuth.AccountId, userAuth.UserId
 
-	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter)
+	peers, err := h.accountManager.GetPeers(r.Context(), accountID, userID, nameFilter, ipFilter, macFilter)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
@@ -571,6 +572,17 @@ func peerToAccessiblePeer(peer *nbpeer.Peer, dnsDomain string) api.AccessiblePee
 	}
 }
 
+func toNetworkAddresses(addrs []nbpeer.NetworkAddress) *[]api.NetworkAddress {
+	if len(addrs) == 0 {
+		return nil
+	}
+	out := make([]api.NetworkAddress, 0, len(addrs))
+	for _, a := range addrs {
+		out = append(out, api.NetworkAddress{NetIp: a.NetIP.String(), Mac: a.Mac})
+	}
+	return &out
+}
+
 func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, approved bool, reason string) *api.Peer {
 	osVersion := peer.Meta.OSVersion
 	if osVersion == "" {
@@ -583,6 +595,7 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
 		Name:                        peer.Name,
 		Ip:                          peer.IP.String(),
 		Ipv6:                        peerIPv6String(peer),
+		NetworkAddresses:            toNetworkAddresses(peer.Meta.NetworkAddresses),
 		ConnectionIp:                peer.Location.ConnectionIP.String(),
 		Connected:                   peer.Status.Connected,
 		LastSeen:                    peer.Status.LastSeen,
@@ -639,6 +652,7 @@ func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dn
 		Name:                        peer.Name,
 		Ip:                          peer.IP.String(),
 		Ipv6:                        peerIPv6String(peer),
+		NetworkAddresses:            toNetworkAddresses(peer.Meta.NetworkAddresses),
 		ConnectionIp:                peer.Location.ConnectionIP.String(),
 		Connected:                   peer.Status.Connected,
 		LastSeen:                    peer.Status.LastSeen,

management/server/http/handlers/peers/peers_handler_test.go

@@ -173,7 +173,7 @@ func initTestMetaData(t *testing.T, peers ...*nbpeer.Peer) *Handler {
 					return nil, fmt.Errorf("user not found")
 				}
 			},
-			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+			GetPeersFunc: func(_ context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 				return peers, nil
 			},
 			GetPeerGroupsFunc: func(ctx context.Context, accountID, peerID string) ([]*types.Group, error) {
@@ -364,6 +364,50 @@ func TestGetPeers(t *testing.T) {
 	}
 }
 
+func TestPeerResponseNetworkAddresses(t *testing.T) {
+	tests := []struct {
+		name      string
+		addresses []nbpeer.NetworkAddress
+		wantJSON  string
+	}{
+		{name: "not reported"},
+		{name: "empty", addresses: []nbpeer.NetworkAddress{}},
+		{
+			name: "multiple interfaces",
+			addresses: []nbpeer.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+				{NetIP: netip.MustParsePrefix("2001:db8::123/64"), Mac: "00:93:37:bd:83:10"},
+			},
+			wantJSON: `[{"net_ip":"192.168.0.11/24","mac":"00:93:37:bd:83:0f"},{"net_ip":"2001:db8::123/64","mac":"00:93:37:bd:83:10"}]`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peer := &nbpeer.Peer{
+				Status: &nbpeer.PeerStatus{},
+				Meta:   nbpeer.PeerSystemMeta{NetworkAddresses: tt.addresses},
+			}
+			responses := map[string]any{
+				"single peer": toSinglePeerResponse(peer, nil, "example.com", true, ""),
+				"peer list":   toPeerListItemResponse(peer, nil, "example.com", 0),
+			}
+			for name, response := range responses {
+				t.Run(name, func(t *testing.T) {
+					body, err := json.Marshal(response)
+					require.NoError(t, err)
+					var fields map[string]json.RawMessage
+					require.NoError(t, json.Unmarshal(body, &fields))
+					if tt.wantJSON == "" {
+						assert.NotContains(t, fields, "network_addresses", "unreported interfaces should be omitted")
+						return
+					}
+					assert.JSONEq(t, tt.wantJSON, string(fields["network_addresses"]), "response should preserve interface addresses and MACs")
+				})
+			}
+		})
+	}
+}
+
 func TestGetAccessiblePeers(t *testing.T) {
 	peer1 := &nbpeer.Peer{
 		ID:                     "peer1",

management/server/http/handlers/proxy/auth.go

@@ -16,21 +16,21 @@ import (
 	"golang.org/x/oauth2"
 
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // AuthCallbackHandler handles OAuth callbacks for proxy authentication.
 type AuthCallbackHandler struct {
 	proxyService   *nbgrpc.ProxyServiceServer
-	rateLimiter    *middleware.APIRateLimiter
+	rateLimiter    *ratelimit.APIRateLimiter
 	trustedProxies []netip.Prefix
 }
 
 // NewAuthCallbackHandler creates a new OAuth callback handler.
 func NewAuthCallbackHandler(proxyService *nbgrpc.ProxyServiceServer, trustedProxies []netip.Prefix) *AuthCallbackHandler {
-	rateLimiterConfig := &middleware.RateLimiterConfig{
+	rateLimiterConfig := &ratelimit.RateLimiterConfig{
 		RequestsPerMinute: 10,
 		Burst:             15,
 		CleanupInterval:   5 * time.Minute,
@@ -39,7 +39,7 @@ func NewAuthCallbackHandler(proxyService *nbgrpc.ProxyServiceServer, trustedProx
 
 	return &AuthCallbackHandler{
 		proxyService:   proxyService,
-		rateLimiter:    middleware.NewAPIRateLimiter(rateLimiterConfig),
+		rateLimiter:    ratelimit.NewAPIRateLimiter(rateLimiterConfig),
 		trustedProxies: trustedProxies,
 	}
 }
@@ -59,7 +59,7 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 
 	state := r.URL.Query().Get("state")
 
-	codeVerifier, originalURL, err := h.proxyService.ValidateState(state)
+	codeVerifier, originalURL, useSessionCode, err := h.proxyService.ValidateState(state)
 	if err != nil {
 		log.WithError(err).Error("OAuth callback state validation failed")
 		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
@@ -119,10 +119,19 @@ func (h *AuthCallbackHandler) handleCallback(w http.ResponseWriter, r *http.Requ
 	redirectURL.Scheme = "https"
 
 	query := redirectURL.Query()
-	query.Set("session_token", sessionToken)
+	if useSessionCode {
+		code, ok := h.proxyService.GenerateSessionCode(sessionToken)
+		if !ok {
+			http.Error(w, "Failed to create session", http.StatusInternalServerError)
+			return
+		}
+		query.Set(auth.SessionCodeQueryParam, code)
+	} else {
+		query.Set(auth.SessionTokenQueryParam, sessionToken)
+	}
 	redirectURL.RawQuery = query.Encode()
 
-	log.WithField("redirect", redirectURL.Host).Debug("OAuth callback: redirecting user with session token")
+	log.WithField("redirect", redirectURL.Host).Debug("OAuth callback: redirecting user to proxy")
 	http.Redirect(w, r, redirectURL.String(), http.StatusFound)
 }
 

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -181,6 +181,10 @@ func (m *testAccessLogManager) GetAllAccessLogs(_ context.Context, _, _ string,
 }
 
 func setupAuthCallbackTest(t *testing.T) *testSetup {
+	return setupAuthCallbackTestWithProxyManager(t, testSessionCodeManager{})
+}
+
+func setupAuthCallbackTestWithProxyManager(t *testing.T, proxyManager nbproxy.Manager) *testSetup {
 	t.Helper()
 
 	ctx := context.Background()
@@ -197,7 +201,7 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	require.NoError(t, err)
 
 	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 
 	usersManager := users.NewManager(testStore)
 
@@ -212,12 +216,12 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	proxyService := nbgrpc.NewProxyServiceServer(
 		&testAccessLogManager{},
 		tokenStore,
-		pkceStore,
+		singleUseStore,
 		oidcConfig,
 		nil,
 		usersManager,
 		nil,
-		nil,
+		proxyManager,
 		nil,
 	)
 
@@ -242,6 +246,15 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	}
 }
 
+type testSessionCodeManager struct {
+	nbproxy.Manager
+	supported bool
+}
+
+func (m testSessionCodeManager) ClusterSupportsSessionCode(_ context.Context, _ string) bool {
+	return m.supported
+}
+
 func createTestReverseProxies(t *testing.T, ctx context.Context, testStore store.Store) {
 	t.Helper()
 
@@ -252,10 +265,11 @@ func createTestReverseProxies(t *testing.T, ctx context.Context, testStore store
 	privKey := base64.StdEncoding.EncodeToString(priv)
 
 	testProxy := &service.Service{
-		ID:        "testProxyId",
-		AccountID: "testAccountId",
-		Name:      "Test Proxy",
-		Domain:    "test-proxy.example.com",
+		ID:           "testProxyId",
+		AccountID:    "testAccountId",
+		Name:         "Test Proxy",
+		Domain:       "test-proxy.example.com",
+		ProxyCluster: "cluster.example.com",
 		Targets: []*service.Target{{
 			Path:       strPtr("/"),
 			Host:       "localhost",
@@ -512,29 +526,56 @@ func createTestState(t *testing.T, ps *nbgrpc.ProxyServiceServer, redirectURL st
 }
 
 func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
-	setup := setupAuthCallbackTest(t)
-	defer setup.cleanup()
+	tests := []struct {
+		name        string
+		manager     nbproxy.Manager
+		wantParam   string
+		absentParam string
+	}{
+		{name: "legacy proxy", manager: testSessionCodeManager{}, wantParam: "session_token", absentParam: "nb_session_code"},
+		{name: "compatible proxy", manager: testSessionCodeManager{supported: true}, wantParam: "nb_session_code", absentParam: "session_token"},
+	}
 
-	setup.oidcServer.tokenSubject = "allowedUserId"
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setup := setupAuthCallbackTestWithProxyManager(t, tt.manager)
+			defer setup.cleanup()
 
-	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+			setup.oidcServer.tokenSubject = "allowedUserId"
+			state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+			req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+			rec := httptest.NewRecorder()
+			setup.router.ServeHTTP(rec, req)
+			require.Equal(t, http.StatusFound, rec.Code)
 
-	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
-	rec := httptest.NewRecorder()
+			location, err := url.Parse(rec.Header().Get("Location"))
+			require.NoError(t, err)
+			require.Equal(t, "test-proxy.example.com", location.Host)
+			require.NotEmpty(t, location.Query().Get(tt.wantParam))
+			require.Empty(t, location.Query().Get(tt.absentParam))
+			require.Empty(t, location.Query().Get("error"))
 
-	setup.router.ServeHTTP(rec, req)
+			if tt.wantParam == "nb_session_code" {
+				code := location.Query().Get("nb_session_code")
+				response, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+					Domain:      location.Hostname(),
+					SessionCode: code,
+				})
+				require.NoError(t, err)
+				require.True(t, response.GetValid())
+				require.NotEmpty(t, response.GetSessionToken())
+				require.NotEqual(t, code, response.GetSessionToken())
 
-	require.Equal(t, http.StatusFound, rec.Code)
-
-	location := rec.Header().Get("Location")
-	require.NotEmpty(t, location)
-
-	parsedLocation, err := url.Parse(location)
-	require.NoError(t, err)
-
-	require.Equal(t, "test-proxy.example.com", parsedLocation.Host)
-	require.NotEmpty(t, parsedLocation.Query().Get("session_token"), "Should include session token")
-	require.Empty(t, parsedLocation.Query().Get("error"), "Should not have error parameter")
+				replayed, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
+					Domain:      location.Hostname(),
+					SessionCode: code,
+				})
+				require.NoError(t, err)
+				require.False(t, replayed.GetValid())
+				require.Empty(t, replayed.GetSessionToken())
+			}
+		})
+	}
 }
 
 // TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account

management/server/http/handlers/users/invites_handler.go

@@ -11,15 +11,15 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 // publicInviteRateLimiter limits public invite requests by IP address to prevent brute-force attacks
-var publicInviteRateLimiter = middleware.NewAPIRateLimiter(&middleware.RateLimiterConfig{
+var publicInviteRateLimiter = ratelimit.NewAPIRateLimiter(&ratelimit.RateLimiterConfig{
 	RequestsPerMinute: 10, // 10 attempts per minute per IP
 	Burst:             5,  // Allow burst of 5 requests
 	CleanupInterval:   10 * time.Minute,

management/server/http/middleware/auth_middleware.go

@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 type EnsureAccountFunc func(ctx context.Context, userAuth auth.UserAuth) (string, string, error)
@@ -33,7 +34,7 @@ type AuthMiddleware struct {
 	ensureAccount       EnsureAccountFunc
 	getUserFromUserAuth GetUserFromUserAuthFunc
 	syncUserJWTGroups   SyncUserJWTGroupsFunc
-	rateLimiter         *APIRateLimiter
+	rateLimiter         *ratelimit.APIRateLimiter
 	patUsageTracker     *PATUsageTracker
 	isValidChildAccount IsValidChildAccountFunc
 }
@@ -44,7 +45,7 @@ func NewAuthMiddleware(
 	ensureAccount EnsureAccountFunc,
 	syncUserJWTGroups SyncUserJWTGroupsFunc,
 	getUserFromUserAuth GetUserFromUserAuthFunc,
-	rateLimiter *APIRateLimiter,
+	rateLimiter *ratelimit.APIRateLimiter,
 	meter metric.Meter,
 	isValidChildAccount IsValidChildAccountFunc,
 ) *AuthMiddleware {

management/server/http/middleware/auth_middleware_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/util"
 	nbauth "github.com/netbirdio/netbird/shared/auth"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
+	"github.com/netbirdio/netbird/shared/ratelimit"
 )
 
 const (
@@ -196,7 +197,7 @@ func TestAuthMiddleware_Handler(t *testing.T) {
 		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
 	}
 
-	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter := ratelimit.NewAPIRateLimiter(nil)
 	disabledLimiter.SetEnabled(false)
 	authMiddleware := NewAuthMiddleware(
 		mockAuth,
@@ -260,7 +261,7 @@ func TestAuthMiddleware_SyncUserJWTGroupsDetachedFromRequestCancellation(t *test
 		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
 	}
 
-	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter := ratelimit.NewAPIRateLimiter(nil)
 	disabledLimiter.SetEnabled(false)
 
 	authMiddleware := NewAuthMiddleware(
@@ -311,7 +312,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("PAT Token Rate Limiting - Burst Works", func(t *testing.T) {
 		// Configure rate limiter: 10 requests per minute with burst of 5
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 10,
 			Burst:             5,
 			CleanupInterval:   5 * time.Minute,
@@ -329,7 +330,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -364,7 +365,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("PAT Token Rate Limiting - Rate Limit Enforced", func(t *testing.T) {
 		// Configure very low rate limit: 1 request per minute
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -382,7 +383,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -408,7 +409,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("Bearer Token Not Rate Limited", func(t *testing.T) {
 		// Configure strict rate limit
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -426,7 +427,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -453,7 +454,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("PAT Token Rate Limiting Per Token", func(t *testing.T) {
 		// Configure rate limiter
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -471,7 +472,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -518,7 +519,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 
 	t.Run("Rate Limiter Cleanup", func(t *testing.T) {
 		// Configure rate limiter with short cleanup interval and TTL for testing
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 60,
 			Burst:             1,
 			CleanupInterval:   100 * time.Millisecond,
@@ -536,7 +537,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -578,7 +579,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 	})
 
 	t.Run("Terraform User Agent Not Rate Limited", func(t *testing.T) {
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -596,7 +597,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -634,7 +635,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 	})
 
 	t.Run("Non-Terraform User Agent With PAT Is Rate Limited", func(t *testing.T) {
-		rateLimitConfig := &RateLimiterConfig{
+		rateLimitConfig := &ratelimit.RateLimiterConfig{
 			RequestsPerMinute: 1,
 			Burst:             1,
 			CleanupInterval:   5 * time.Minute,
@@ -652,7 +653,7 @@ func TestAuthMiddleware_RateLimiting(t *testing.T) {
 			func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
 				return &types.User{}, nil
 			},
-			NewAPIRateLimiter(rateLimitConfig),
+			ratelimit.NewAPIRateLimiter(rateLimitConfig),
 			nil,
 			func(_ context.Context, _, _, _ string) bool { return false },
 		)
@@ -740,7 +741,7 @@ func TestAuthMiddleware_Handler_Child(t *testing.T) {
 		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
 	}
 
-	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter := ratelimit.NewAPIRateLimiter(nil)
 	disabledLimiter.SetEnabled(false)
 	authMiddleware := NewAuthMiddleware(
 		mockAuth,

management/server/http/middleware/middleware_factory.go

@@ -0,0 +1,35 @@
+package middleware
+
+import (
+	"github.com/gorilla/mux"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/auth"
+	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/shared/ratelimit"
+	"github.com/rs/cors"
+	log "github.com/sirupsen/logrus"
+)
+
+func BuildMiddleware(rateLimiter *ratelimit.APIRateLimiter, authManager auth.Manager, accountManager account.Manager, metrics telemetry.AppMetrics, isValidChildAcctFunc IsValidChildAccountFunc) []mux.MiddlewareFunc {
+	toret := make([]mux.MiddlewareFunc, 0)
+
+	toret = append(toret, metrics.HTTPMiddleware().Handler)
+	toret = append(toret, cors.AllowAll().Handler)
+
+	if rateLimiter == nil {
+		log.Warn("NewAPIHandler: nil rate limiter, rate limiting disabled")
+		rateLimiter = ratelimit.NewAPIRateLimiter(nil)
+		rateLimiter.SetEnabled(false)
+	}
+	toret = append(toret, NewAuthMiddleware(
+		authManager,
+		accountManager.GetAccountIDFromUserAuth,
+		accountManager.SyncUserJWTGroups,
+		accountManager.GetUserFromUserAuth,
+		rateLimiter,
+		metrics.GetMeter(),
+		isValidChildAcctFunc,
+	).Handler)
+
+	return toret
+}

management/server/http/middleware/rate_limiter.go

@@ -1,288 +0,0 @@
-package middleware
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"os"
-	"strconv"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/time/rate"
-
-	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/trustedproxy"
-)
-
-const (
-	RateLimitingEnabledEnv        = "NB_API_RATE_LIMITING_ENABLED"
-	RateLimitingBurstEnv          = "NB_API_RATE_LIMITING_BURST"
-	RateLimitingRPMEnv            = "NB_API_RATE_LIMITING_RPM"
-	RateLimitingTrustedProxiesEnv = "NB_API_RATE_LIMITING_TRUSTED_PROXIES"
-
-	defaultAPIRPM   = 6
-	defaultAPIBurst = 500
-)
-
-// RateLimiterConfig holds configuration for the API rate limiter
-type RateLimiterConfig struct {
-	// RequestsPerMinute defines the rate at which tokens are replenished
-	RequestsPerMinute float64
-	// Burst defines the maximum number of requests that can be made in a burst
-	Burst int
-	// CleanupInterval defines how often to clean up old limiters (how often garbage collection runs)
-	CleanupInterval time.Duration
-	// LimiterTTL defines how long a limiter should be kept after last use (age threshold for removal)
-	LimiterTTL time.Duration
-	// TrustedProxies lists the upstream proxies whose forwarding headers may be
-	// believed. Empty means requests are keyed by their direct peer address.
-	TrustedProxies *trustedproxy.List
-}
-
-// DefaultRateLimiterConfig returns a default configuration
-func DefaultRateLimiterConfig() *RateLimiterConfig {
-	return &RateLimiterConfig{
-		RequestsPerMinute: 100,
-		Burst:             120,
-		CleanupInterval:   5 * time.Minute,
-		LimiterTTL:        10 * time.Minute,
-	}
-}
-
-func RateLimiterConfigFromEnv() (cfg *RateLimiterConfig, enabled bool) {
-	rpm := defaultAPIRPM
-	if v := os.Getenv(RateLimitingRPMEnv); v != "" {
-		value, err := strconv.Atoi(v)
-		if err != nil {
-			log.Warnf("parsing %s env var: %v, using default %d", RateLimitingRPMEnv, err, rpm)
-		} else {
-			rpm = value
-		}
-	}
-	if rpm <= 0 {
-		log.Warnf("%s=%d is non-positive, using default %d", RateLimitingRPMEnv, rpm, defaultAPIRPM)
-		rpm = defaultAPIRPM
-	}
-
-	burst := defaultAPIBurst
-	if v := os.Getenv(RateLimitingBurstEnv); v != "" {
-		value, err := strconv.Atoi(v)
-		if err != nil {
-			log.Warnf("parsing %s env var: %v, using default %d", RateLimitingBurstEnv, err, burst)
-		} else {
-			burst = value
-		}
-	}
-	if burst <= 0 {
-		log.Warnf("%s=%d is non-positive, using default %d", RateLimitingBurstEnv, burst, defaultAPIBurst)
-		burst = defaultAPIBurst
-	}
-
-	trusted, err := trustedproxy.Parse(os.Getenv(RateLimitingTrustedProxiesEnv))
-	if err != nil {
-		log.Warnf("parsing %s env var: %v, trusting no proxies", RateLimitingTrustedProxiesEnv, err)
-		trusted = nil
-	}
-
-	return &RateLimiterConfig{
-		RequestsPerMinute: float64(rpm),
-		Burst:             burst,
-		CleanupInterval:   6 * time.Hour,
-		LimiterTTL:        24 * time.Hour,
-		TrustedProxies:    trusted,
-	}, os.Getenv(RateLimitingEnabledEnv) == "true"
-}
-
-// limiterEntry holds a rate limiter and its last access time
-type limiterEntry struct {
-	limiter    *rate.Limiter
-	lastAccess time.Time
-}
-
-// APIRateLimiter manages rate limiting for API tokens
-type APIRateLimiter struct {
-	config   *RateLimiterConfig
-	limiters map[string]*limiterEntry
-	mu       sync.RWMutex
-	stopChan chan struct{}
-	enabled  atomic.Bool
-}
-
-// NewAPIRateLimiter creates a new API rate limiter with the given configuration
-func NewAPIRateLimiter(config *RateLimiterConfig) *APIRateLimiter {
-	if config == nil {
-		config = DefaultRateLimiterConfig()
-	}
-
-	rl := &APIRateLimiter{
-		config:   config,
-		limiters: make(map[string]*limiterEntry),
-		stopChan: make(chan struct{}),
-	}
-	rl.enabled.Store(true)
-
-	go rl.cleanupLoop()
-
-	return rl
-}
-
-func (rl *APIRateLimiter) SetEnabled(enabled bool) {
-	rl.enabled.Store(enabled)
-}
-
-func (rl *APIRateLimiter) Enabled() bool {
-	return rl.enabled.Load()
-}
-
-func (rl *APIRateLimiter) UpdateConfig(config *RateLimiterConfig) {
-	if config == nil {
-		return
-	}
-	if config.RequestsPerMinute <= 0 || config.Burst <= 0 {
-		log.Warnf("UpdateConfig: ignoring invalid rpm=%v burst=%d", config.RequestsPerMinute, config.Burst)
-		return
-	}
-
-	newRPS := rate.Limit(config.RequestsPerMinute / 60.0)
-	newBurst := config.Burst
-
-	rl.mu.Lock()
-	rl.config.RequestsPerMinute = config.RequestsPerMinute
-	rl.config.Burst = newBurst
-	snapshot := make([]*rate.Limiter, 0, len(rl.limiters))
-	for _, entry := range rl.limiters {
-		snapshot = append(snapshot, entry.limiter)
-	}
-	rl.mu.Unlock()
-
-	for _, l := range snapshot {
-		l.SetLimit(newRPS)
-		l.SetBurst(newBurst)
-	}
-}
-
-// Allow checks if a request for the given key (token) is allowed
-func (rl *APIRateLimiter) Allow(key string) bool {
-	if !rl.enabled.Load() {
-		return true
-	}
-	limiter := rl.getLimiter(key)
-	return limiter.Allow()
-}
-
-// Wait blocks until the rate limiter allows another request for the given key
-// Returns an error if the context is canceled
-func (rl *APIRateLimiter) Wait(ctx context.Context, key string) error {
-	if !rl.enabled.Load() {
-		return nil
-	}
-	limiter := rl.getLimiter(key)
-	return limiter.Wait(ctx)
-}
-
-// getLimiter retrieves or creates a rate limiter for the given key
-func (rl *APIRateLimiter) getLimiter(key string) *rate.Limiter {
-	rl.mu.RLock()
-	entry, exists := rl.limiters[key]
-	rl.mu.RUnlock()
-
-	if exists {
-		rl.mu.Lock()
-		entry.lastAccess = time.Now()
-		rl.mu.Unlock()
-		return entry.limiter
-	}
-
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-
-	if entry, exists := rl.limiters[key]; exists {
-		entry.lastAccess = time.Now()
-		return entry.limiter
-	}
-
-	requestsPerSecond := rl.config.RequestsPerMinute / 60.0
-	limiter := rate.NewLimiter(rate.Limit(requestsPerSecond), rl.config.Burst)
-	rl.limiters[key] = &limiterEntry{
-		limiter:    limiter,
-		lastAccess: time.Now(),
-	}
-
-	return limiter
-}
-
-// cleanupLoop periodically removes old limiters that haven't been used recently
-func (rl *APIRateLimiter) cleanupLoop() {
-	ticker := time.NewTicker(rl.config.CleanupInterval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ticker.C:
-			rl.cleanup()
-		case <-rl.stopChan:
-			return
-		}
-	}
-}
-
-// cleanup removes limiters that haven't been used within the TTL period
-func (rl *APIRateLimiter) cleanup() {
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-
-	now := time.Now()
-	for key, entry := range rl.limiters {
-		if now.Sub(entry.lastAccess) > rl.config.LimiterTTL {
-			delete(rl.limiters, key)
-		}
-	}
-}
-
-// Stop stops the cleanup goroutine
-func (rl *APIRateLimiter) Stop() {
-	close(rl.stopChan)
-}
-
-// Reset removes the rate limiter for a specific key
-func (rl *APIRateLimiter) Reset(key string) {
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-	delete(rl.limiters, key)
-}
-
-// Middleware returns an HTTP middleware that rate limits requests by client IP.
-// Returns 429 Too Many Requests if the rate limit is exceeded.
-func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !rl.enabled.Load() {
-			next.ServeHTTP(w, r)
-			return
-		}
-		clientIP := getClientIP(r, rl.config.TrustedProxies)
-		if !rl.Allow(clientIP) {
-			util.WriteErrorResponse("rate limit exceeded, please try again later", http.StatusTooManyRequests, w)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-// getClientIP extracts the client IP address from the request. Forwarding headers
-// are used only when the request arrives from a trusted proxy.
-func getClientIP(r *http.Request, trusted *trustedproxy.List) string {
-	if !trusted.Empty() {
-		if addr := trusted.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For")); addr.IsValid() {
-			return addr.String()
-		}
-	}
-
-	ip, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		return r.RemoteAddr
-	}
-	return ip
-}

management/server/http/middleware/rate_limiter_test.go

@@ -1,376 +0,0 @@
-package middleware
-
-import (
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/trustedproxy"
-)
-
-func TestAPIRateLimiter_Allow(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60, // 1 per second
-		Burst:             2,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	// First two requests should be allowed (burst)
-	assert.True(t, rl.Allow("test-key"))
-	assert.True(t, rl.Allow("test-key"))
-
-	// Third request should be denied (exceeded burst)
-	assert.False(t, rl.Allow("test-key"))
-
-	// Different key should be allowed
-	assert.True(t, rl.Allow("different-key"))
-}
-
-func TestAPIRateLimiter_Middleware(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60, // 1 per second
-		Burst:             2,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	// Create a simple handler that returns 200 OK
-	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-
-	// Wrap with rate limiter middleware
-	handler := rl.Middleware(nextHandler)
-
-	// First two requests should pass (burst)
-	for i := 0; i < 2; i++ {
-		req := httptest.NewRequest(http.MethodGet, "/test", nil)
-		req.RemoteAddr = "192.168.1.1:12345"
-		rr := httptest.NewRecorder()
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusOK, rr.Code, "request %d should be allowed", i+1)
-	}
-
-	// Third request should be rate limited
-	req := httptest.NewRequest(http.MethodGet, "/test", nil)
-	req.RemoteAddr = "192.168.1.1:12345"
-	rr := httptest.NewRecorder()
-	handler.ServeHTTP(rr, req)
-	assert.Equal(t, http.StatusTooManyRequests, rr.Code)
-}
-
-func TestAPIRateLimiter_Middleware_DifferentIPs(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             1,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-
-	handler := rl.Middleware(nextHandler)
-
-	// Request from first IP
-	req1 := httptest.NewRequest(http.MethodGet, "/test", nil)
-	req1.RemoteAddr = "192.168.1.1:12345"
-	rr1 := httptest.NewRecorder()
-	handler.ServeHTTP(rr1, req1)
-	assert.Equal(t, http.StatusOK, rr1.Code)
-
-	// Second request from first IP should be rate limited
-	req2 := httptest.NewRequest(http.MethodGet, "/test", nil)
-	req2.RemoteAddr = "192.168.1.1:12345"
-	rr2 := httptest.NewRecorder()
-	handler.ServeHTTP(rr2, req2)
-	assert.Equal(t, http.StatusTooManyRequests, rr2.Code)
-
-	// Request from different IP should be allowed
-	req3 := httptest.NewRequest(http.MethodGet, "/test", nil)
-	req3.RemoteAddr = "192.168.1.2:12345"
-	rr3 := httptest.NewRecorder()
-	handler.ServeHTTP(rr3, req3)
-	assert.Equal(t, http.StatusOK, rr3.Code)
-}
-
-func TestGetClientIP(t *testing.T) {
-	tests := []struct {
-		name       string
-		remoteAddr string
-		expected   string
-	}{
-		{
-			name:       "remote addr with port",
-			remoteAddr: "192.168.1.1:12345",
-			expected:   "192.168.1.1",
-		},
-		{
-			name:       "remote addr without port",
-			remoteAddr: "192.168.1.1",
-			expected:   "192.168.1.1",
-		},
-		{
-			name:       "IPv6 with port",
-			remoteAddr: "[::1]:12345",
-			expected:   "::1",
-		},
-		{
-			name:       "IPv6 without port",
-			remoteAddr: "::1",
-			expected:   "::1",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			req := httptest.NewRequest(http.MethodGet, "/test", nil)
-			req.RemoteAddr = tc.remoteAddr
-			assert.Equal(t, tc.expected, getClientIP(req, nil))
-		})
-	}
-}
-
-func TestAPIRateLimiter_Reset(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             1,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	// Use up the burst
-	assert.True(t, rl.Allow("test-key"))
-	assert.False(t, rl.Allow("test-key"))
-
-	// Reset the limiter
-	rl.Reset("test-key")
-
-	// Should be allowed again
-	assert.True(t, rl.Allow("test-key"))
-}
-
-func TestAPIRateLimiter_SetEnabled(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             1,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	assert.True(t, rl.Allow("key"))
-	assert.False(t, rl.Allow("key"), "burst exhausted while enabled")
-
-	rl.SetEnabled(false)
-	assert.False(t, rl.Enabled())
-	for i := 0; i < 5; i++ {
-		assert.True(t, rl.Allow("key"), "disabled limiter must always allow")
-	}
-
-	rl.SetEnabled(true)
-	assert.True(t, rl.Enabled())
-	assert.False(t, rl.Allow("key"), "re-enabled limiter retains prior bucket state")
-}
-
-func TestAPIRateLimiter_UpdateConfig(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             2,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	assert.True(t, rl.Allow("k1"))
-	assert.True(t, rl.Allow("k1"))
-	assert.False(t, rl.Allow("k1"), "burst=2 exhausted")
-
-	rl.UpdateConfig(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             10,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-
-	// New burst applies to existing keys in place; bucket refills up to new burst over time,
-	// but importantly newly-added keys use the updated config immediately.
-	assert.True(t, rl.Allow("k2"))
-	for i := 0; i < 9; i++ {
-		assert.True(t, rl.Allow("k2"))
-	}
-	assert.False(t, rl.Allow("k2"), "new burst=10 exhausted")
-}
-
-func TestAPIRateLimiter_UpdateConfig_NilIgnored(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             1,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	rl.UpdateConfig(nil) // must not panic or zero the config
-
-	assert.True(t, rl.Allow("k"))
-	assert.False(t, rl.Allow("k"))
-}
-
-func TestAPIRateLimiter_UpdateConfig_NonPositiveIgnored(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 60,
-		Burst:             1,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	assert.True(t, rl.Allow("k"))
-	assert.False(t, rl.Allow("k"))
-
-	rl.UpdateConfig(&RateLimiterConfig{RequestsPerMinute: 0, Burst: 0, CleanupInterval: time.Minute, LimiterTTL: time.Minute})
-	rl.UpdateConfig(&RateLimiterConfig{RequestsPerMinute: -1, Burst: 5, CleanupInterval: time.Minute, LimiterTTL: time.Minute})
-	rl.UpdateConfig(&RateLimiterConfig{RequestsPerMinute: 60, Burst: -1, CleanupInterval: time.Minute, LimiterTTL: time.Minute})
-
-	rl.Reset("k")
-	assert.True(t, rl.Allow("k"))
-	assert.False(t, rl.Allow("k"), "burst should still be 1 — invalid UpdateConfig calls were ignored")
-}
-
-func TestAPIRateLimiter_ConcurrentAllowAndUpdate(t *testing.T) {
-	rl := NewAPIRateLimiter(&RateLimiterConfig{
-		RequestsPerMinute: 600,
-		Burst:             10,
-		CleanupInterval:   time.Minute,
-		LimiterTTL:        time.Minute,
-	})
-	defer rl.Stop()
-
-	var wg sync.WaitGroup
-	stop := make(chan struct{})
-
-	for i := 0; i < 8; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			key := fmt.Sprintf("k%d", id)
-			for {
-				select {
-				case <-stop:
-					return
-				default:
-					rl.Allow(key)
-				}
-			}
-		}(i)
-	}
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for i := 0; i < 200; i++ {
-			select {
-			case <-stop:
-				return
-			default:
-				rl.UpdateConfig(&RateLimiterConfig{
-					RequestsPerMinute: float64(30 + (i % 90)),
-					Burst:             1 + (i % 20),
-					CleanupInterval:   time.Minute,
-					LimiterTTL:        time.Minute,
-				})
-				rl.SetEnabled(i%2 == 0)
-			}
-		}
-	}()
-
-	time.Sleep(100 * time.Millisecond)
-	close(stop)
-	wg.Wait()
-}
-
-func TestRateLimiterConfigFromEnv(t *testing.T) {
-	t.Setenv(RateLimitingEnabledEnv, "true")
-	t.Setenv(RateLimitingRPMEnv, "42")
-	t.Setenv(RateLimitingBurstEnv, "7")
-
-	cfg, enabled := RateLimiterConfigFromEnv()
-	assert.True(t, enabled)
-	assert.Equal(t, float64(42), cfg.RequestsPerMinute)
-	assert.Equal(t, 7, cfg.Burst)
-
-	t.Setenv(RateLimitingEnabledEnv, "false")
-	_, enabled = RateLimiterConfigFromEnv()
-	assert.False(t, enabled)
-
-	t.Setenv(RateLimitingEnabledEnv, "")
-	t.Setenv(RateLimitingRPMEnv, "")
-	t.Setenv(RateLimitingBurstEnv, "")
-	cfg, enabled = RateLimiterConfigFromEnv()
-	assert.False(t, enabled)
-	assert.Equal(t, float64(defaultAPIRPM), cfg.RequestsPerMinute)
-	assert.Equal(t, defaultAPIBurst, cfg.Burst)
-
-	t.Setenv(RateLimitingRPMEnv, "0")
-	t.Setenv(RateLimitingBurstEnv, "-5")
-	cfg, _ = RateLimiterConfigFromEnv()
-	assert.Equal(t, float64(defaultAPIRPM), cfg.RequestsPerMinute, "non-positive rpm must fall back to default")
-	assert.Equal(t, defaultAPIBurst, cfg.Burst, "non-positive burst must fall back to default")
-}
-
-func TestGetClientIP_TrustedProxies(t *testing.T) {
-	trusted, err := trustedproxy.Parse("10.0.0.0/8")
-	require.NoError(t, err)
-
-	tests := []struct {
-		name       string
-		list       *trustedproxy.List
-		remoteAddr string
-		xff        string
-		expected   string
-	}{
-		{
-			name:       "no trusted proxies ignores the header",
-			remoteAddr: "10.0.0.1:5555",
-			xff:        "1.1.1.1, 2.2.2.2",
-			expected:   "10.0.0.1",
-		},
-		{
-			name:       "behind a trusted proxy uses the right-most untrusted hop",
-			list:       trusted,
-			remoteAddr: "10.0.0.1:5555",
-			xff:        "1.1.1.1, 2.2.2.2",
-			expected:   "2.2.2.2",
-		},
-		{
-			name:       "a caller reaching us directly cannot forge the header",
-			list:       trusted,
-			remoteAddr: "203.0.113.5:5555",
-			xff:        "1.1.1.1",
-			expected:   "203.0.113.5",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			req := httptest.NewRequest(http.MethodGet, "/test", nil)
-			req.RemoteAddr = tc.remoteAddr
-			req.Header.Set("X-Forwarded-For", tc.xff)
-
-			assert.Equal(t, tc.expected, getClientIP(req, tc.list))
-		})
-	}
-}

management/server/http/testing/testing_tools/channel/channel.go

@@ -29,7 +29,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 
 	"github.com/netbirdio/netbird/management/server"
@@ -40,20 +39,21 @@ import (
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	http2 "github.com/netbirdio/netbird/management/server/http"
+	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
 	"github.com/netbirdio/netbird/management/server/networks/routers"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
-	"github.com/netbirdio/netbird/management/server/store"
+	nbstore "github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/users"
 	"github.com/netbirdio/netbird/shared/auth"
 )
 
 func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPeerUpdate *network_map.UpdateMessage, validateUpdate bool) (http.Handler, account.Manager, chan struct{}) {
-	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
+	store, cleanup, err := nbstore.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
 	if err != nil {
 		t.Fatalf("Failed to create test store: %v", err)
 	}
@@ -88,7 +88,6 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -102,21 +101,21 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
 
-	accessLogsManager := accesslogsmanager.NewManager(store, permissionsManager, nil)
+	accessLogsManager := accesslogsmanager.NewManager(accesslogsmanager.NewRepository(store.(*nbstore.SqlStore).Conn()), store, permissionsManager, nil)
 	proxyTokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceverifierStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 	noopMeter := noop.NewMeterProvider().Meter("")
 	proxyMgr, err := proxymanager.NewManager(store, noopMeter)
 	if err != nil {
 		t.Fatalf("Failed to create proxy manager: %v", err)
 	}
-	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, pkceverifierStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
+	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
 	// NewProxyServiceServer starts cleanupStaleProxies on a context it derives
 	// from context.Background(), independent of the cancellable ctx above;
 	// Close() cancels it so the goroutine does not outlive the test.
@@ -147,7 +146,10 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics, nil)...)
+	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager,
+		groupsManager, geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
+		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
@@ -204,7 +206,7 @@ func PeerShouldNotReceiveAnyUpdate(t testing_tools.TB, updateMessage <-chan *net
 // BuildApiBlackBoxWithDBStateAndPeerChannel creates the API handler and returns
 // the peer update channel directly so tests can verify updates inline.
 func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile string) (http.Handler, account.Manager, <-chan *network_map.UpdateMessage) {
-	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
+	store, cleanup, err := nbstore.NewTestStoreFromSQL(context.Background(), sqlFile, t.TempDir())
 	if err != nil {
 		t.Fatalf("Failed to create test store: %v", err)
 	}
@@ -228,7 +230,6 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 
 	geoMock := &geolocation.Mock{}
 	validatorMock := server.MockIntegratedValidator{}
-	proxyController := integrations.NewController(store)
 	userManager := users.NewManager(store)
 	permissionsManager := permissions.NewManager(store)
 	settingsManager := settings.NewManager(store, userManager, integrations.NewManager(&activity.InMemoryEventStore{}), permissionsManager, settings.IdpConfig{})
@@ -242,21 +243,21 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	}
 
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{}, nil)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, settingsManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
 
-	accessLogsManager := accesslogsmanager.NewManager(store, permissionsManager, nil)
+	accessLogsManager := accesslogsmanager.NewManager(accesslogsmanager.NewRepository(store.(*nbstore.SqlStore).Conn()), store, permissionsManager, nil)
 	proxyTokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceverifierStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	singleUseStore := nbgrpc.NewSingleUseStore(ctx, cacheStore)
 	noopMeter := noop.NewMeterProvider().Meter("")
 	proxyMgr, err := proxymanager.NewManager(store, noopMeter)
 	if err != nil {
 		t.Fatalf("Failed to create proxy manager: %v", err)
 	}
-	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, pkceverifierStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
+	proxyServiceServer := nbgrpc.NewProxyServiceServer(accessLogsManager, proxyTokenStore, singleUseStore, nbgrpc.ProxyOIDCConfig{}, peersManager, userManager, nil, proxyMgr, nil)
 	// NewProxyServiceServer starts cleanupStaleProxies on a context it derives
 	// from context.Background(), independent of the cancellable ctx above;
 	// Close() cancels it so the goroutine does not outlive the test.
@@ -287,7 +288,10 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil)
+	apiRouter.Use(middleware.BuildMiddleware(nil, authManagerMock, am, metrics, nil)...)
+	apiHandler, err := http2.NewAPIHandler(ctx, apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager,
+		geoMock, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager,
+		networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}

management/server/identity_provider_test.go

@@ -23,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/idp"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -112,8 +111,8 @@ func createManagerWithEmbeddedIdPModeAndSetup(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, testStore)
-	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
-	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	networkMapController := controller.NewController(ctx, testStore, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(testStore, peersManager), &config.Config{}, nil)
+	manager, err := BuildManager(ctx, &config.Config{}, testStore, networkMapController, job.NewJobManager(nil, testStore, peersManager), idpManager, singleAccountModeDomain, eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}

management/server/integrated_validator.go

@@ -100,7 +100,7 @@ func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountI
 		return nil, nil, err
 	}
 
-	peers, err = am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
+	peers, err = am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
 	if err != nil {
 		return nil, nil, err
 	}

management/server/integrations/port_forwarding/controller.go

@@ -1,38 +0,0 @@
-package port_forwarding
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-type Controller interface {
-	SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer)
-	GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error)
-	IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error)
-}
-
-type ControllerMock struct {
-}
-
-func NewControllerMock() *ControllerMock {
-	return &ControllerMock{}
-}
-
-func (c *ControllerMock) SendUpdate(ctx context.Context, accountID string, affectedProxyID string, affectedPeerIDs []string, accountPeers map[string]*peer.Peer) {
-	// noop
-}
-
-func (c *ControllerMock) GetProxyNetworkMaps(ctx context.Context, accountID, peerID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) GetProxyNetworkMapsAll(ctx context.Context, accountID string, accountPeers map[string]*peer.Peer) (map[string]*nbtypes.NetworkMap, error) {
-	return make(map[string]*nbtypes.NetworkMap), nil
-}
-
-func (c *ControllerMock) IsPeerInIngressPorts(ctx context.Context, accountID, peerID string) (bool, error) {
-	return false, nil
-}

management/server/job/manager.go

@@ -57,6 +57,7 @@ func (jm *Manager) CreateJobChannel(ctx context.Context, accountID, peerID strin
 	if ch, ok := jm.jobChannels[peerID]; ok {
 		ch.Close()
 		delete(jm.jobChannels, peerID)
+		jm.failPendingLocked(ctx, accountID, peerID, "Pending job cleanup: job stream replaced by a newer stream")
 	}
 
 	ch := NewChannel()
@@ -127,24 +128,35 @@ func (jm *Manager) HandleResponse(ctx context.Context, resp *proto.JobResponse,
 	return nil
 }
 
-// CloseChannel closes a peer’s channel and cleans up its jobs
-func (jm *Manager) CloseChannel(ctx context.Context, accountID, peerID string) {
+// CloseChannel closes the peer's job channel session and fails its pending jobs. It does nothing
+// when a newer job stream has registered a different channel for the peer.
+func (jm *Manager) CloseChannel(ctx context.Context, accountID, peerID string, session *Channel) {
 	jm.mu.Lock()
 	defer jm.mu.Unlock()
 
 	if ch, ok := jm.jobChannels[peerID]; ok {
+		if ch != session {
+			log.WithContext(ctx).Debugf("skipped closing job channel: peer %s is owned by a newer job stream", peerID)
+			return
+		}
 		ch.Close()
 		delete(jm.jobChannels, peerID)
 	}
 
+	jm.failPendingLocked(ctx, accountID, peerID, "Time out peer disconnected")
+}
+
+// failPendingLocked marks the peer's pending jobs as failed and drops them from memory. The caller
+// must hold jm.mu.
+func (jm *Manager) failPendingLocked(ctx context.Context, accountID, peerID, reason string) {
 	for jobID, ev := range jm.pending {
-		if ev.PeerID == peerID {
-			// if the client disconnect and there is pending job then mark it as failed
-			if err := jm.Store.MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, "Time out peer disconnected"); err != nil {
-				log.WithContext(ctx).Errorf("failed to mark pending jobs as failed: %v", err)
-			}
-			delete(jm.pending, jobID)
+		if ev.PeerID != peerID {
+			continue
 		}
+		if err := jm.Store.MarkPendingJobsAsFailed(ctx, accountID, peerID, jobID, reason); err != nil {
+			log.WithContext(ctx).Errorf("failed to mark pending jobs as failed: %v", err)
+		}
+		delete(jm.pending, jobID)
 	}
 }
 

management/server/job/manager_test.go

@@ -0,0 +1,78 @@
+package job
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+func TestCloseChannel_OwnSession(t *testing.T) {
+	ctx := context.Background()
+	mockStore := store.NewMockStore(gomock.NewController(t))
+	jm := NewJobManager(nil, mockStore, nil)
+
+	session := NewChannel()
+	jm.jobChannels["peer-1"] = session
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+	jm.pending["job-2"] = &Event{PeerID: "peer-2"}
+
+	mockStore.EXPECT().MarkPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", "job-1", gomock.Any()).Return(nil)
+
+	jm.CloseChannel(ctx, "account-1", "peer-1", session)
+
+	assert.False(t, jm.IsPeerConnected("peer-1"))
+	_, err := session.Event(ctx)
+	assert.ErrorIs(t, err, ErrJobChannelClosed)
+	assert.NotContains(t, jm.pending, "job-1")
+	assert.Contains(t, jm.pending, "job-2", "jobs of other peers must be kept")
+}
+
+func TestCloseChannel_NewerSessionOwnsPeer(t *testing.T) {
+	ctx := context.Background()
+	jm := NewJobManager(nil, store.NewMockStore(gomock.NewController(t)), nil)
+
+	stale := NewChannel()
+	current := NewChannel()
+	jm.jobChannels["peer-1"] = current
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+
+	jm.CloseChannel(ctx, "account-1", "peer-1", stale)
+
+	require.True(t, jm.IsPeerConnected("peer-1"))
+	assert.Contains(t, jm.pending, "job-1", "jobs served by the newer stream must not be failed")
+
+	event := &Event{PeerID: "peer-1"}
+	require.NoError(t, current.AddEvent(ctx, time.Second, event))
+	got, err := current.Event(ctx)
+	require.NoError(t, err, "newer session channel must stay open")
+	assert.Equal(t, event, got)
+}
+
+func TestCreateJobChannel_ReplacesSessionAndDropsItsPendingJobs(t *testing.T) {
+	ctx := context.Background()
+	mockStore := store.NewMockStore(gomock.NewController(t))
+	jm := NewJobManager(nil, mockStore, nil)
+
+	stale := NewChannel()
+	jm.jobChannels["peer-1"] = stale
+	jm.pending["job-1"] = &Event{PeerID: "peer-1"}
+	jm.pending["job-2"] = &Event{PeerID: "peer-2"}
+
+	mockStore.EXPECT().MarkAllPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", gomock.Any()).Return(nil)
+	mockStore.EXPECT().MarkPendingJobsAsFailed(gomock.Any(), "account-1", "peer-1", "job-1", "Pending job cleanup: job stream replaced by a newer stream").Return(nil)
+
+	current := jm.CreateJobChannel(ctx, "account-1", "peer-1")
+
+	require.NotSame(t, stale, current)
+	_, err := stale.Event(ctx)
+	assert.ErrorIs(t, err, ErrJobChannelClosed, "replaced channel must be closed")
+	assert.True(t, jm.IsPeerConnected("peer-1"))
+	assert.False(t, jm.IsPeerHasPendingJobs("peer-1"), "jobs of the replaced stream must be dropped")
+	assert.Contains(t, jm.pending, "job-2", "jobs of other peers must be kept")
+}

management/server/management_proto_test.go

@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -376,9 +375,9 @@ func startManagementForTest(t *testing.T, testFile string, config *config.Config
 		return nil, nil, "", cleanup, err
 	}
 
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeralMgr, config, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeralMgr, config, nil)
 	accountManager, err := BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "",
-		eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+		eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 
 	if err != nil {
 		cleanup()

management/server/management_test.go

@@ -10,10 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	pb "github.com/golang/protobuf/proto" //nolint
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -30,7 +30,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/activity"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/groups"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -216,7 +215,7 @@ func startServer(
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(ctx, str)
-	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
+	networkMapController := controller.NewController(ctx, str, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(str, peers.NewManager(str, permissionsManager)), config, nil)
 
 	accountManager, err := server.BuildManager(
 		context.Background(),
@@ -231,7 +230,6 @@ func startServer(
 		false,
 		server.MockIntegratedValidator{},
 		metrics,
-		port_forwarding.NewControllerMock(),
 		settingsMockManager,
 		permissionsManager,
 		false,

management/server/mock_server/account_mock.go

@@ -39,7 +39,7 @@ type MockAccountManager struct {
 	GetAccountIDByUserIdFunc              func(ctx context.Context, userAuth auth.UserAuth) (string, error)
 	GetUserFromUserAuthFunc               func(ctx context.Context, userAuth auth.UserAuth) (*types.User, error)
 	ListUsersFunc                         func(ctx context.Context, accountID string) ([]*types.User, error)
-	GetPeersFunc                          func(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetPeersFunc                          func(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
 	MarkPeerConnectedFunc                 func(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64, nmap *types.NetworkMap) error
 	MarkPeerDisconnectedFunc              func(ctx context.Context, peerKey string, accountID string, sessionStartedAt int64) error
 	SyncAndMarkPeerFunc                   func(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error)
@@ -807,9 +807,9 @@ func (am *MockAccountManager) GetAccountIDFromUserAuth(ctx context.Context, user
 }
 
 // GetPeers mocks GetPeers of the AccountManager interface
-func (am *MockAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+func (am *MockAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 	if am.GetPeersFunc != nil {
-		return am.GetPeersFunc(ctx, accountID, userID, nameFilter, ipFilter)
+		return am.GetPeersFunc(ctx, accountID, userID, nameFilter, ipFilter, macFilter)
 	}
 	return nil, status.Errorf(codes.Unimplemented, "method GetPeers is not implemented")
 }

management/server/nameserver_test.go

@@ -6,9 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -803,9 +802,9 @@ func createNSManager(t *testing.T) (*DefaultAccountManager, error) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 }
 
 func createNSStore(t *testing.T) (store.Store, error) {
@@ -966,147 +965,151 @@ func TestValidateDomain(t *testing.T) {
 }
 
 func TestNameServerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	var newNameServerGroupA *nbdns.NameServerGroup
-	var newNameServerGroupB *nbdns.NameServerGroup
+		var newNameServerGroupA *nbdns.NameServerGroup
+		var newNameServerGroupB *nbdns.NameServerGroup
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{},
-	})
-	assert.NoError(t, err)
-
-	err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupB",
-		Name:  "GroupB",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Creating a nameserver group with a distribution group no peers should not update account peers
-	// and not send peer update
-	t.Run("creating nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newNameServerGroupA, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupA"},
-			true, []string{}, true, userID, false,
-		)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// saving a nameserver group with a distribution group with no peers should not update account peers
-	// and not send peer update
-	t.Run("saving nameserver group with distribution group no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+		err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupB",
+			Name:  "GroupB",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
-	t.Run("creating nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating a nameserver group with a distribution group no peers should not update account peers
+		// and not send peer update
+		step(t, "creating nameserver group with distribution group no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
 
-		newNameServerGroupB, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupB"},
-			true, []string{}, true, userID, false,
-		)
-		assert.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			newNameServerGroupA, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupA"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
 
-	// saving a nameserver group with a distribution group with peers should update account peers and send peer update
-	t.Run("saving nameserver group with distribution group has peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		newNameServerGroupB.NameServers = []nbdns.NameServer{
-			{
-				IP:     netip.MustParseAddr("1.1.1.2"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-			{
-				IP:     netip.MustParseAddr("8.8.8.8"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			},
-		}
-		err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
-		assert.NoError(t, err)
+		// saving a nameserver group with a distribution group with no peers should not update account peers
+		// and not send peer update
+		step(t, "saving nameserver group with distribution group no peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA)
+			assert.NoError(t, err)
 
-	// Deleting a nameserver group should update account peers and send peer update
-	t.Run("deleting nameserver group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
-		assert.NoError(t, err)
+		// Creating a nameserver group with a distribution group no peers should update account peers and send peer update
+		step(t, "creating nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+			newNameServerGroupB, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupB"},
+				true, []string{}, true, userID, false,
+			)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// saving a nameserver group with a distribution group with peers should update account peers and send peer update
+		step(t, "saving nameserver group with distribution group has peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			newNameServerGroupB.NameServers = []nbdns.NameServer{
+				{
+					IP:     netip.MustParseAddr("1.1.1.2"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+				{
+					IP:     netip.MustParseAddr("8.8.8.8"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				},
+			}
+			err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting a nameserver group should update account peers and send peer update
+		step(t, "deleting nameserver group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }

management/server/peer.go

@@ -47,7 +47,7 @@ const (
 
 // GetPeers returns peers visible to the user within an account.
 // Users with "peers:read" see all peers. Otherwise, users see only their own peers, or none if restricted by account settings.
-func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 	user, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
 	if err != nil {
 		return nil, err
@@ -59,7 +59,7 @@ func (am *DefaultAccountManager) GetPeers(ctx context.Context, accountID, userID
 	}
 
 	if allowed {
-		return am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, nameFilter, ipFilter)
+		return am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, nameFilter, ipFilter, macFilter)
 	}
 
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
@@ -710,11 +710,11 @@ func (am *DefaultAccountManager) handleUserAddedPeer(ctx context.Context, accoun
 func (am *DefaultAccountManager) handleSetupKeyAddedPeer(ctx context.Context, encodedHashedKey string, peer *nbpeer.Peer, opEvent *activity.Event, config *peerAddAuthConfig) error {
 	sk, err := am.Store.GetSetupKeyBySecret(ctx, store.LockingStrengthNone, encodedHashedKey)
 	if err != nil {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return err
 	}
 
 	if !sk.IsValid() {
-		return status.Errorf(status.NotFound, "couldn't add peer: setup key is invalid")
+		return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 	}
 
 	if !sk.AllowExtraDNSLabels && len(peer.ExtraDNSLabels) > 0 {
@@ -915,12 +915,12 @@ func (am *DefaultAccountManager) AddPeer(ctx context.Context, accountID, setupKe
 			case addedBySetupKey:
 				sk, err := transaction.GetSetupKeyBySecret(ctx, store.LockingStrengthUpdate, encodedHashedKey)
 				if err != nil {
-					return fmt.Errorf("failed to get setup key: %w", err)
+					return err
 				}
 
 				// we validate at the end to not block the setup key for too long
 				if !sk.IsValid() {
-					return status.Errorf(status.PreconditionFailed, "couldn't add peer: setup key is invalid")
+					return status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 				}
 
 				err = transaction.IncrementSetupKeyUsage(ctx, peerAddConfig.SetupKeyID)
@@ -1839,15 +1839,6 @@ func deletePeers(ctx context.Context, am *DefaultAccountManager, transaction sto
 
 // validatePeerDelete checks if the peer can be deleted.
 func (am *DefaultAccountManager) validatePeerDelete(ctx context.Context, transaction store.Store, accountId, peerId string) error {
-	linkedInIngressPorts, err := am.proxyController.IsPeerInIngressPorts(ctx, accountId, peerId)
-	if err != nil {
-		return err
-	}
-
-	if linkedInIngressPorts {
-		return status.Errorf(status.PreconditionFailed, "peer is linked to ingress ports: %s", peerId)
-	}
-
 	linked, router := isPeerLinkedToNetworkRouter(ctx, transaction, accountId, peerId)
 	if linked {
 		return status.Errorf(status.PreconditionFailed, "peer is linked to a network router: %s", router.ID)

management/server/peer_test.go

@@ -4,10 +4,14 @@ import (
 	"context"
 	"crypto/sha256"
 	b64 "encoding/base64"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net"
+	"net/http"
+	"net/http/httptest"
 	"net/netip"
+	"net/url"
 	"os"
 	"runtime"
 	"strconv"
@@ -33,12 +37,14 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/internals/shared/grpc"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	peershandler "github.com/netbirdio/netbird/management/server/http/handlers/peers"
 	"github.com/netbirdio/netbird/management/server/http/testing/testing_tools"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
 	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/status"
 
 	"github.com/netbirdio/netbird/management/server/util"
@@ -718,7 +724,7 @@ func TestDefaultAccountManager_GetPeers(t *testing.T) {
 				return
 			}
 
-			peers, err := manager.GetPeers(context.Background(), accountID, someUser, "", "")
+			peers, err := manager.GetPeers(context.Background(), accountID, someUser, "", "", "")
 			if err != nil {
 				t.Fatal(err)
 				return
@@ -731,6 +737,71 @@ func TestDefaultAccountManager_GetPeers(t *testing.T) {
 	}
 }
 
+func TestDefaultAccountManager_GetPeers_FilterByMac(t *testing.T) {
+	ctx := context.Background()
+	manager, _, err := createManager(t)
+	require.NoError(t, err)
+	account := newAccountWithId(ctx, "mac-account", "mac-admin", "", "", "", false)
+	account.Peers["matching"] = &nbpeer.Peer{
+		ID: "matching", Key: "matching-key", Name: "laptop", DNSLabel: "laptop",
+		IP: netip.MustParseAddr("100.64.0.10"), Status: &nbpeer.PeerStatus{LastSeen: time.Now()},
+		Meta: nbpeer.PeerSystemMeta{NetworkAddresses: []nbpeer.NetworkAddress{
+			{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+			{NetIP: netip.MustParsePrefix("192.168.1.11/24"), Mac: "aa:bb:cc:dd:ee:ff"},
+		}},
+	}
+	account.Peers["other"] = &nbpeer.Peer{
+		ID: "other", Key: "other-key", Name: "desktop", DNSLabel: "desktop",
+		IP: netip.MustParseAddr("100.64.0.20"), Status: &nbpeer.PeerStatus{LastSeen: time.Now()},
+	}
+	require.NoError(t, manager.Store.SaveAccount(ctx, account))
+	otherAccount := newAccountWithId(ctx, "other-account", "other-admin", "", "", "", false)
+	otherPeer := account.Peers["matching"].Copy()
+	otherPeer.ID, otherPeer.Key = "outside-account", "outside-key"
+	otherAccount.Peers[otherPeer.ID] = otherPeer
+	require.NoError(t, manager.Store.SaveAccount(ctx, otherAccount))
+	handler := peershandler.NewHandler(manager, manager.networkMapController, manager.permissionsManager)
+
+	tests := []struct {
+		name, nameFilter, ipFilter, macFilter string
+		wantIDs                               []string
+	}{
+		{name: "no filter", wantIDs: []string{"matching", "other"}},
+		{name: "full MAC", macFilter: "00:93:37:bd:83:0f", wantIDs: []string{"matching"}},
+		{name: "partial MAC", macFilter: "93:37:bd", wantIDs: []string{"matching"}},
+		{name: "second interface", macFilter: "aa:bb:cc:dd:ee:ff", wantIDs: []string{"matching"}},
+		{name: "unknown MAC", macFilter: "11:22:33:44:55:66"},
+		{name: "combined filters", nameFilter: "laptop", ipFilter: "100.64.0.10", macFilter: "00:93:37", wantIDs: []string{"matching"}},
+		{name: "name mismatch", nameFilter: "desktop", macFilter: "00:93:37"},
+		{name: "IP mismatch", ipFilter: "100.64.0.20", macFilter: "00:93:37"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := manager.GetPeers(ctx, account.Id, "mac-admin", tt.nameFilter, tt.ipFilter, tt.macFilter)
+			require.NoError(t, err)
+			ids := make([]string, 0, len(peers))
+			for _, peer := range peers {
+				ids = append(ids, peer.ID)
+			}
+			assert.ElementsMatch(t, tt.wantIDs, ids, "filters should return only matching peers in the account")
+
+			query := url.Values{"name": {tt.nameFilter}, "ip": {tt.ipFilter}, "mac": {tt.macFilter}}
+			req := httptest.NewRequest(http.MethodGet, "/api/peers?"+query.Encode(), nil)
+			req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{AccountId: account.Id, UserId: "mac-admin"})
+			recorder := httptest.NewRecorder()
+			handler.GetAllPeers(recorder, req)
+			require.Equal(t, http.StatusOK, recorder.Code, "peer listing should succeed: %s", recorder.Body.String())
+			var response []api.PeerBatch
+			require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &response))
+			responseIDs := make([]string, 0, len(response))
+			for _, peer := range response {
+				responseIDs = append(responseIDs, peer.Id)
+			}
+			assert.ElementsMatch(t, tt.wantIDs, responseIDs, "HTTP query filters should reach the store")
+		})
+	}
+}
+
 func setupTestAccountManager(b testing.TB, peers int, groups int) (*DefaultAccountManager, *update_channel.PeersUpdateManager, string, string, error) {
 	b.Helper()
 
@@ -934,7 +1005,7 @@ func BenchmarkGetPeers(b *testing.B) {
 
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				_, err := manager.GetPeers(context.Background(), accountID, userID, "", "")
+				_, err := manager.GetPeers(context.Background(), accountID, userID, "", "", "")
 				if err != nil {
 					b.Fatalf("GetPeers failed: %v", err)
 				}
@@ -1154,20 +1225,6 @@ func TestToSyncResponse(t *testing.T) {
 		FirewallRules: []*types.FirewallRule{
 			{PeerIP: "192.168.1.2", Direction: types.FirewallRuleDirectionIN, Action: string(types.PolicyTrafficActionAccept), Protocol: string(types.PolicyRuleProtocolTCP), Port: "80"},
 		},
-		ForwardingRules: []*types.ForwardingRule{
-			{
-				RuleProtocol: "tcp",
-				DestinationPorts: types.RulePortRange{
-					Start: 1000,
-					End:   2000,
-				},
-				TranslatedAddress: net.IPv4(192, 168, 1, 2),
-				TranslatedPorts: types.RulePortRange{
-					Start: 11000,
-					End:   12000,
-				},
-			},
-		},
 	}
 	dnsName := "example.com"
 	checks := []*nmdata.PostureChecks{
@@ -1262,14 +1319,6 @@ func TestToSyncResponse(t *testing.T) {
 	// assert posture checks
 	assert.Equal(t, 1, len(response.Checks))
 	assert.Equal(t, "/usr/bin/netbird", response.Checks[0].Files[0])
-	// assert network map ForwardingRules
-	assert.Equal(t, 1, len(response.NetworkMap.ForwardingRules))
-	assert.Equal(t, proto.RuleProtocol_TCP, response.NetworkMap.ForwardingRules[0].Protocol)
-	assert.Equal(t, uint32(1000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().Start)
-	assert.Equal(t, uint32(2000), response.NetworkMap.ForwardingRules[0].DestinationPort.GetRange().End)
-	assert.Equal(t, net.IPv4(192, 168, 1, 2).To4(), net.IP(response.NetworkMap.ForwardingRules[0].TranslatedAddress))
-	assert.Equal(t, uint32(11000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().Start)
-	assert.Equal(t, uint32(12000), response.NetworkMap.ForwardingRules[0].TranslatedPort.GetRange().End)
 }
 
 func Test_RegisterPeerByUser(t *testing.T) {
@@ -1301,9 +1350,9 @@ func Test_RegisterPeerByUser(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1392,9 +1441,9 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1446,7 +1495,7 @@ func Test_RegisterPeerBySetupKey(t *testing.T) {
 			name:                      "Absent setup key",
 			existingSetupKeyID:        "AAAAAAAA-38F5-4553-B31E-DD66C696CEBB",
 			expectAddPeerError:        true,
-			errorType:                 status.NotFound,
+			errorType:                 status.PermissionDenied,
 			expectedErrorMsgSubstring: "couldn't add peer: setup key is invalid",
 		},
 	}
@@ -1551,9 +1600,9 @@ func Test_RegisterPeerRollbackOnFailure(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1636,9 +1685,9 @@ func Test_LoginPeer(t *testing.T) {
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, s)
-	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, s, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", ephemeral_manager.NewEphemeralManager(s, peers.NewManager(s, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(context.Background(), nil, s, networkMapController, job.NewJobManager(nil, s, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	assert.NoError(t, err)
 
 	existingAccountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
@@ -1772,374 +1821,336 @@ func Test_LoginPeer(t *testing.T) {
 }
 
 func TestPeerAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
-	require.NoError(t, err)
-
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err)
-	}
-
-	// create a user with auto groups
-	_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
-		{
-			Id:         "regularUser1",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupA"},
-		},
-		{
-			Id:         "regularUser2",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupB"},
-		},
-		{
-			Id:         "regularUser3",
-			AccountID:  account.Id,
-			Role:       types.UserRoleAdmin,
-			Issued:     types.UserIssuedAPI,
-			AutoGroups: []string{"groupC"},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	var peer4 *nbpeer.Peer
-	var peer5 *nbpeer.Peer
-	var peer6 *nbpeer.Peer
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// Updating not expired peer and peer expiration is enabled should not update account peers and not send peer update
-	t.Run("updating not expired peer and peer expiration is enabled", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.UpdatePeer(context.Background(), account.Id, userID, peer2)
+		err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
 		}
-	})
-
-	// Adding peer to unlinked group should not update account peers and not send peer update
-	t.Run("adding peer to unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
-
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:  expectedPeerKey,
-			Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Deleting peer with unlinked group should not update account peers and not send peer update
-	t.Run("deleting peer with unlinked group", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating peer label should update account peers and send peer update
-	t.Run("updating peer label", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		peer1.Name = "peer-1"
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires update", func(t *testing.T) {
-		requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, true, nil
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err)
 		}
 
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	t.Run("validator requires no update", func(t *testing.T) {
-		t.Skip("Currently all updates will trigger a network map")
-
-		requireNoUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
-			return update, false, nil
-		}
-
-		manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireNoUpdateFunc}
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Adding peer to group linked with policy should update account peers and send peer update
-	t.Run("adding peer to group linked with policy", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupA"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		// create a user with auto groups
+		_, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{
+			{
+				Id:         "regularUser1",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupA"},
+			},
+			{
+				Id:         "regularUser2",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupB"},
+			},
+			{
+				Id:         "regularUser3",
+				AccountID:  account.Id,
+				Role:       types.UserRoleAdmin,
+				Issued:     types.UserIssuedAPI,
+				AutoGroups: []string{"groupC"},
 			},
 		}, true)
 		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		var peer4 *nbpeer.Peer
+		var peer5 *nbpeer.Peer
+		var peer6 *nbpeer.Peer
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		// Adding peer to unlinked group should not update account peers and not send peer update
+		step(t, "adding peer to unlinked group", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-	// Deleting peer with linked group to policy should update account peers and send peer update
-	t.Run("deleting peer with linked group to policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:  expectedPeerKey,
+				Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Deleting peer with unlinked group should not update account peers and not send peer update
+		step(t, "deleting peer with unlinked group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// drain any buffered updates from previous subtests
-	drainPeerUpdates(updMsg)
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with route should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with route", func(t *testing.T) {
-		route := nbroute.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
-			NetID:       "superNet",
-			NetworkType: nbroute.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupB"},
-		}
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
+		// Updating peer label should update account peers and send peer update
+		step(t, "updating peer label", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			peer1.Name = "peer-1"
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		expectedPeerKey := key.PublicKey().String()
-		peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+		step(t, "validator requires update", func(t *testing.T) {
+			requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) {
+				return update, true, nil
+			}
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+			manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc}
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to route should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			_, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Adding peer to group linked with policy should update account peers and send peer update
+		step(t, "adding peer to group linked with policy", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			require.NoError(t, err)
 
-	// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
-	t.Run("adding peer to group linked with name server group", func(t *testing.T) {
-		_, err = manager.CreateNameServerGroup(
-			context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
-				IP:     netip.MustParseAddr("1.1.1.1"),
-				NSType: nbdns.UDPNameServerType,
-				Port:   nbdns.DefaultDNSPort,
-			}},
-			[]string{"groupC"},
-			true, []string{}, true, userID, false,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
 
-		key, err := wgtypes.GeneratePrivateKey()
-		require.NoError(t, err)
+			expectedPeerKey := key.PublicKey().String()
+			peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
 
-		expectedPeerKey := key.PublicKey().String()
-		peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
-			Key:                    expectedPeerKey,
-			LoginExpirationEnabled: true,
-			Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
-		}, false)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
+		// Deleting peer with linked group to policy should update account peers and send peer update
+		step(t, "deleting peer with linked group to policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
-	t.Run("deleting peer with linked group to route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID)
+			require.NoError(t, err)
 
-		err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
-		require.NoError(t, err)
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		// drain any buffered updates from previous subtests
+		drainPeerUpdates(updMsg)
+
+		// Adding peer to group linked with route should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with route", func(t *testing.T) {
+			route := nbroute.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: nbroute.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupB"},
+			}
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to route should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Adding peer to group linked with name server group should update peers in that group, not unrelated peers
+		step(t, "adding peer to group linked with name server group", func(t *testing.T) {
+			_, err = manager.CreateNameServerGroup(
+				context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{
+					IP:     netip.MustParseAddr("1.1.1.1"),
+					NSType: nbdns.UDPNameServerType,
+					Port:   nbdns.DefaultDNSPort,
+				}},
+				[]string{"groupC"},
+				true, []string{}, true, userID, false,
+			)
+			require.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			key, err := wgtypes.GeneratePrivateKey()
+			require.NoError(t, err)
+
+			expectedPeerKey := key.PublicKey().String()
+			peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{
+				Key:                    expectedPeerKey,
+				LoginExpirationEnabled: true,
+				Meta:                   nbpeer.PeerSystemMeta{Hostname: expectedPeerKey},
+			}, false)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Deleting peer with linked group to name server group should update peers in that group, not unrelated peers
+		step(t, "deleting peer with linked group to name server group", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 
@@ -2631,6 +2642,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
@@ -2651,6 +2664,8 @@ func TestHandleSetupKeyAddedPeer(t *testing.T) {
 
 		err = manager.handleSetupKeyAddedPeer(context.Background(), encodedHashedKey, peer, opEvent, config)
 		require.Error(t, err)
+		require.IsType(t, &status.Error{}, err)
+		require.Equal(t, err.(*status.Error).ErrorType, status.PermissionDenied)
 		assert.Contains(t, err.Error(), "setup key is invalid")
 	})
 
@@ -2787,45 +2802,47 @@ func TestPeerWillHaveIPv6(t *testing.T) {
 // flipping --disable-ipv6) without bumping its WtVersion, other account peers
 // receive a fresh network map so their AAAA records for it become unstale.
 func TestSyncPeer_IPv6CapabilityChangePropagates(t *testing.T) {
-	manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t)
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
 
-	// Drain any initial updates from setup.
-	drain := func() {
-		for {
-			select {
-			case <-updMsg:
-			case <-time.After(200 * time.Millisecond):
-				return
+		// Drain any initial updates from setup.
+		drain := func() {
+			for {
+				select {
+				case <-updMsg:
+				case <-time.After(200 * time.Millisecond):
+					return
+				}
 			}
 		}
-	}
-	drain()
+		drain()
 
-	t.Run("no propagation when capabilities are unchanged", func(t *testing.T) {
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            peer2.Meta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldNotReceiveUpdate(t, updMsg)
-	})
+		step(t, "no propagation when capabilities are unchanged", func(t *testing.T) {
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            peer2.Meta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldNotReceiveUpdate(t, updMsg)
+		})
 
-	t.Run("propagation when IPv6 capability is added", func(t *testing.T) {
-		newMeta := peer2.Meta
-		newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
-		newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
+		step(t, "propagation when IPv6 capability is added", func(t *testing.T) {
+			newMeta := peer2.Meta
+			newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...)
+			newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay)
 
-		_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
-			WireGuardPubKey: peer2.Key,
-			Meta:            newMeta,
-		}, peer2.AccountID)
-		require.NoError(t, err)
-		peerShouldReceiveUpdate(t, updMsg)
+			_, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{
+				WireGuardPubKey: peer2.Key,
+				Meta:            newMeta,
+			}, peer2.AccountID)
+			require.NoError(t, err)
+			peerShouldReceiveUpdate(t, updMsg)
+		})
 	})
 }
 

management/server/permissions/agent_network_roles_test.go

@@ -62,11 +62,11 @@ func TestAgentNetworkAdminRole(t *testing.T) {
 	}
 }
 
-// TestUsageViewerRole pins the least-privilege cost role: read on the
-// aggregated usage overview plus read-only on the resources its filters
-// and display columns resolve against (users, groups, peers, the provider
-// list) — no policies, no request-level logs (which can contain captured
-// prompts), nothing else in the account.
+// TestUsageViewerRole pins the read-only usage role: read on the aggregated
+// usage overview and the account-wide request-level logs, plus read-only on
+// the resources their filters and display columns resolve against (users,
+// groups, peers, the provider list) — no policies, guardrails, budgets, or
+// settings, nothing else in the account.
 func TestUsageViewerRole(t *testing.T) {
 	manager := NewManager(nil)
 	ctx := context.Background()
@@ -76,6 +76,7 @@ func TestUsageViewerRole(t *testing.T) {
 
 	readOnly := []modules.Module{
 		modules.AgentNetworkUsage,
+		modules.AgentNetworkLogs,
 		modules.AgentNetworkProviders,
 		modules.Users,
 		modules.Groups,
@@ -83,7 +84,7 @@ func TestUsageViewerRole(t *testing.T) {
 	}
 	for _, m := range readOnly {
 		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
-			"usage_viewer must read %s for the usage view and its filters", m)
+			"usage_viewer must read %s for the usage and log views and their filters", m)
 		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
 			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
 				"usage_viewer must not have %s on %s", op, m)
@@ -95,7 +96,6 @@ func TestUsageViewerRole(t *testing.T) {
 		modules.AgentNetworkPolicies,
 		modules.AgentNetworkGuardrails,
 		modules.AgentNetworkBudgets,
-		modules.AgentNetworkLogs,
 		modules.AgentNetworkSettings,
 		modules.Networks,
 		modules.SetupKeys,

management/server/permissions/roles/usage_viewer.go

@@ -7,16 +7,15 @@ import (
 )
 
 // UsageViewer is the regular User baseline plus read access to the
-// aggregated Agent Network usage and cost overview, and read-only access
-// to the resources the usage filters and display columns resolve against:
-// users and groups (identity filters and name resolution), peers (agent
-// principals in the caller column), and the provider list (provider and
-// model filter options — the manager redacts connection config such as
-// upstream URLs and operator-supplied header values for callers holding
-// read without update). It sees no policies and no account-wide
-// request-level access logs (which can contain captured prompts); its own
-// requests remain readable through the self-scoped endpoints, like any
-// caller's.
+// aggregated Agent Network usage and cost overview and to the account-wide
+// request-level access logs (which can contain captured prompts), and
+// read-only access to the resources the usage and log filters and display
+// columns resolve against: users and groups (identity filters and name
+// resolution), peers (agent principals in the caller column), and the
+// provider list (provider and model filter options — the manager redacts
+// connection config such as upstream URLs and operator-supplied header
+// values for callers holding read without update). It sees no policies,
+// guardrails, budgets, or Agent Network settings.
 var UsageViewer = RolePermissions{
 	Role: types.UserRoleUsageViewer,
 	AutoAllowNew: map[operations.Operation]bool{
@@ -32,6 +31,12 @@ var UsageViewer = RolePermissions{
 			operations.Update: false,
 			operations.Delete: false,
 		},
+		modules.AgentNetworkLogs: {
+			operations.Read:   true,
+			operations.Create: false,
+			operations.Update: false,
+			operations.Delete: false,
+		},
 		modules.AgentNetworkProviders: {
 			operations.Read:   true,
 			operations.Create: false,

management/server/policy_test.go

@@ -1135,287 +1135,291 @@ func sortFunc() func(a *types.FirewallRule, b *types.FirewallRule) int {
 }
 
 func TestPolicyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupD",
-			Name:  "GroupD",
-			Peers: []string{peer1.ID, peer2.ID},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	var policyWithGroupRulesNoPeers *types.Policy
-	var policyWithDestinationPeersOnly *types.Policy
-	var policyWithSourceAndDestinationPeers *types.Policy
-	var err error
-
-	// Saving policy with rule groups with no peers should not update account's peers and not send peer update
-	t.Run("saving policy with rule groups with no peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer3.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Saving policy with source group containing peers, but destination group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where source has peers but destination does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("saving policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupC"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Protocol:      types.PolicyRuleProtocolTCP,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Saving policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("saving policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			AccountID: account.Id,
-			Enabled:   true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupD"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
+			{
+				ID:    "groupD",
+				Name:  "GroupD",
+				Peers: []string{peer1.ID, peer2.ID},
 			},
-		}, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
 		}
-	})
-
-	// Disabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("disabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = false
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating disabled policy with destination and source groups containing peers should still update account's peers
-	// because affected peer resolution does not filter by policy enabled state
-	t.Run("updating disabled policy with source and destination groups with peers", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Description = "updated description"
-		policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Enabling policy with destination and source groups containing peers should update account's peers
-	// and send peer update
-	t.Run("enabling policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policyWithSourceAndDestinationPeers.Enabled = true
-		policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy should trigger account peers update and send peer update
-	t.Run("deleting policy with source and destination groups with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
 
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		var policyWithGroupRulesNoPeers *types.Policy
+		var policyWithDestinationPeersOnly *types.Policy
+		var policyWithSourceAndDestinationPeers *types.Policy
+		var err error
+
+		// Saving policy with rule groups with no peers should not update account's peers and not send peer update
+		step(t, "saving policy with rule groups with no peers", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving policy with source group containing peers, but destination group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where source has peers but destination does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "saving policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupC"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Protocol:      types.PolicyRuleProtocolTCP,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Saving policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "saving policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				AccountID: account.Id,
+				Enabled:   true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupD"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+			}, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Disabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "disabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = false
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating disabled policy with destination and source groups containing peers should still update account's peers
+		// because affected peer resolution does not filter by policy enabled state
+		step(t, "updating disabled policy with source and destination groups with peers", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Description = "updated description"
+			policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"}
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Enabling policy with destination and source groups containing peers should update account's peers
+		// and send peer update
+		step(t, "enabling policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policyWithSourceAndDestinationPeers.Enabled = true
+			policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy should trigger account peers update and send peer update
+		step(t, "deleting policy with source and destination groups with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+
+		})
+
+		// Deleting policy with destination group containing peers, but source group without peers should
+		// update account's peers and send peer update
+		step(t, "deleting policy where destination has peers but source does not", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting policy with no peers in groups should not update account's peers and not send peer update
+		step(t, "deleting policy with no peers in groups", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 	})
-
-	// Deleting policy with destination group containing peers, but source group without peers should
-	// update account's peers and send peer update
-	t.Run("deleting policy where destination has peers but source does not", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting policy with no peers in groups should not update account's peers and not send peer update
-	t.Run("deleting policy with no peers in groups", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
 }

management/server/posture_checks_test.go

@@ -123,324 +123,334 @@ func initTestPostureChecksAccount(am *DefaultAccountManager) (*types.Account, er
 }
 
 func TestPostureCheckAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err := manager.CreateGroup(context.Background(), account.Id, userID, group)
-		assert.NoError(t, err)
-	}
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	postureCheckA := &posture.Checks{
-		Name:      "postureCheckA",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
-			},
-		},
-	}
-	postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
-	require.NoError(t, err)
-
-	postureCheckB := &posture.Checks{
-		Name:      "postureCheckB",
-		AccountID: account.Id,
-		Checks: posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.28.0",
-			},
-		},
-	}
-
-	// Saving unused posture check should not update account peers and not send peer update
-	t.Run("saving unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating unused posture check should not update account peers and not send peer update
-	t.Run("updating unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
+		g := []*types.Group{
 			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"groupA"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{peer1.ID, peer2.ID, peer3.ID},
 			},
-		},
-		SourcePostureChecks: []string{postureCheckB.ID},
-	}
-
-	// Linking posture check to policy should trigger update account peers and send peer update
-	t.Run("linking posture check to policy with peers", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture checks should update account peers and send peer update
-	t.Run("updating linked to posture check with peers", func(t *testing.T) {
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
 			},
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
-				},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
 			},
 		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
+		for _, group := range g {
+			err := manager.CreateGroup(context.Background(), account.Id, userID, group)
+			assert.NoError(t, err)
 		}
-	})
 
-	// Removing posture check from policy should trigger account peers update and send peer update
-	t.Run("removing posture check from policy", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		policy.SourcePostureChecks = []string{}
-		_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting unused posture check should not trigger account peers update and not send peer update
-	t.Run("deleting unused posture check", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-	assert.NoError(t, err)
-
-	// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
-	t.Run("updating linked posture check to policy with no peers", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupB"},
-					Destinations:  []string{"groupC"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
-				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
-		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-	})
-
-	// Updating linked posture check to policy where destination has peers but source does not
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
-		updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
 		t.Cleanup(func() {
-			updateManager.CloseChannel(context.Background(), peer2.ID)
+			updateManager.CloseChannel(context.Background(), peer1.ID)
 		})
 
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+		postureCheckA := &posture.Checks{
+			Name:      "postureCheckA",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
+					},
+				},
+			},
+		}
+		postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true)
+		require.NoError(t, err)
+
+		postureCheckB := &posture.Checks{
+			Name:      "postureCheckB",
+			AccountID: account.Id,
+			Checks: posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.28.0",
+				},
+			},
+		}
+
+		// Saving unused posture check should not update account peers and not send peer update
+		step(t, "saving unused posture check", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating unused posture check should not update account peers and not send peer update
+		step(t, "updating unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		policy := &types.Policy{
 			Enabled: true,
 			Rules: []*types.PolicyRule{
 				{
 					Enabled:       true,
-					Sources:       []string{"groupB"},
+					Sources:       []string{"groupA"},
 					Destinations:  []string{"groupA"},
 					Bidirectional: true,
 					Action:        types.PolicyTrafficActionAccept,
 				},
 			},
 			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg1)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			NBVersionCheck: &posture.NBVersionCheck{
-				MinVersion: "0.29.0",
-			},
 		}
-		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Linking posture check to policy should trigger update account peers and send peer update
+		step(t, "linking posture check to policy with peers", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-	// Updating linked client posture check to policy where source has peers but destination does not,
-	// should trigger account peers update and send peer update
-	t.Run("updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
-		_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{
-				{
-					Enabled:       true,
-					Sources:       []string{"groupA"},
-					Destinations:  []string{"groupB"},
-					Bidirectional: true,
-					Action:        types.PolicyTrafficActionAccept,
+			policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture checks should update account peers and send peer update
+		step(t, "updating linked to posture check with peers", func(t *testing.T) {
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
 				},
-			},
-			SourcePostureChecks: []string{postureCheckB.ID},
-		}, true)
-		assert.NoError(t, err)
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		postureCheckB.Checks = posture.ChecksDefinition{
-			ProcessCheck: &posture.ProcessCheck{
-				Processes: []posture.Process{
-					{
-						LinuxPath: "/usr/bin/netbird",
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"},
 					},
 				},
-			},
-		}
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Removing posture check from policy should trigger account peers update and send peer update
+		step(t, "removing posture check from policy", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			policy.SourcePostureChecks = []string{}
+			_, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Deleting unused posture check should not trigger account peers update and not send peer update
+		step(t, "deleting unused posture check", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
 		_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update
+		step(t, "updating linked posture check to policy with no peers", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupC"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Updating linked posture check to policy where destination has peers but source does not
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) {
+			updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID)
+			t.Cleanup(func() {
+				updateManager.CloseChannel(context.Background(), peer2.ID)
+			})
+
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupB"},
+						Destinations:  []string{"groupA"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg, updMsg1)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg1)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				NBVersionCheck: &posture.NBVersionCheck{
+					MinVersion: "0.29.0",
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Updating linked client posture check to policy where source has peers but destination does not,
+		// should trigger account peers update and send peer update
+		step(t, "updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) {
+			_, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{
+				Enabled: true,
+				Rules: []*types.PolicyRule{
+					{
+						Enabled:       true,
+						Sources:       []string{"groupA"},
+						Destinations:  []string{"groupB"},
+						Bidirectional: true,
+						Action:        types.PolicyTrafficActionAccept,
+					},
+				},
+				SourcePostureChecks: []string{postureCheckB.ID},
+			}, true)
+			assert.NoError(t, err)
+
+			settleAffectedUpdates(updMsg)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			postureCheckB.Checks = posture.ChecksDefinition{
+				ProcessCheck: &posture.ProcessCheck{
+					Processes: []posture.Process{
+						{
+							LinuxPath: "/usr/bin/netbird",
+						},
+					},
+				},
+			}
+			_, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 

management/server/route_test.go

@@ -6,10 +6,10 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
 	"github.com/rs/xid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/cache"
-	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -1262,7 +1261,10 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	}
 	eventStore := &activity.InMemoryEventStore{}
 
-	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
 	require.NoError(t, err)
 
 	ctrl := gomock.NewController(t)
@@ -1290,21 +1292,22 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel.
 	permissionsManager := permissions.NewManager(store)
 	peersManager := peers.NewManager(store, permissionsManager)
 
-	ctx := context.Background()
-
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
+	// A go-cache janitor only stops through a GC finalizer, which would leave synctest bubbles with a goroutine that never exits.
+	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
-	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
+	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil)
 
-	am, err := BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, settingsMockManager, permissionsManager, false, cacheStore)
 	if err != nil {
 		return nil, nil, err
 	}
+	cacheManager := am.cacheManager
+	t.Cleanup(func() { _ = cacheManager.Close() })
 	return am, updateManager, nil
 }
 
@@ -1893,265 +1896,269 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) {
 }
 
 func TestRouteAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, err := createRouterManager(t)
-	require.NoError(t, err, "failed to create account manager")
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, err := createRouterManager(t)
+		require.NoError(t, err, "failed to create account manager")
 
-	account, err := initTestRouteAccount(t, manager)
-	require.NoError(t, err, "failed to init testing account")
+		account, err := initTestRouteAccount(t, manager)
+		require.NoError(t, err, "failed to init testing account")
 
-	g := []*types.Group{
-		{
-			ID:    "groupA",
-			Name:  "GroupA",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{},
-		},
-		{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{},
-		},
-	}
-	for _, group := range g {
-		err = manager.CreateGroup(context.Background(), account.Id, userID, group)
-		require.NoError(t, err, "failed to create group %s", group.Name)
-	}
+		g := []*types.Group{
+			{
+				ID:    "groupA",
+				Name:  "GroupA",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{},
+			},
+			{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{},
+			},
+		}
+		for _, group := range g {
+			err = manager.CreateGroup(context.Background(), account.Id, userID, group)
+			require.NoError(t, err, "failed to create group %s", group.Name)
+		}
 
-	updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1ID)
-	})
+		updMsg := updateManager.CreateChannel(context.Background(), peer1ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1ID)
+		})
 
-	// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
-	t.Run("creating route no routing peer and no peers in groups", func(t *testing.T) {
-		route := route.Route{
-			ID:          "testingRoute1",
-			Network:     netip.MustParsePrefix("100.65.250.202/32"),
+		// Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update
+		step(t, "creating route no routing peer and no peers in groups", func(t *testing.T) {
+			settleAffectedUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute1",
+				Network:     netip.MustParsePrefix("100.65.250.202/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupA"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupA"},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
+		step(t, "creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
+			drainPeerUpdates(updMsg)
+
+			route := route.Route{
+				ID:          "testingRoute2",
+				Network:     netip.MustParsePrefix("192.0.2.0/32"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{routeGroup3},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup3},
+			}
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
+				route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
+				route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+
+		})
+
+		baseRoute := route.Route{
+			ID:          "testingRoute3",
+			Network:     netip.MustParsePrefix("192.168.0.0/16"),
 			NetID:       "superNet",
 			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupA"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupA"},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	// Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update
-	t.Run("creating a route with peers in  PeerGroups and Groups", func(t *testing.T) {
-		drainPeerUpdates(updMsg)
-
-		route := route.Route{
-			ID:          "testingRoute2",
-			Network:     netip.MustParsePrefix("192.0.2.0/32"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{routeGroup3},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{routeGroup3},
-		}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer,
-			route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric,
-			route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply,
-		)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
-
-	})
-
-	baseRoute := route.Route{
-		ID:          "testingRoute3",
-		Network:     netip.MustParsePrefix("192.168.0.0/16"),
-		NetID:       "superNet",
-		NetworkType: route.IPv4Network,
-		Peer:        peer1ID,
-		Description: "super",
-		Masquerade:  false,
-		Metric:      9999,
-		Enabled:     true,
-		Groups:      []string{routeGroup1},
-	}
-
-	// Creating route should update account peers and send peer update
-	t.Run("creating route with a routing peer", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		newRoute, err := manager.CreateRoute(
-			context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
-			baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
-			baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
-		baseRoute = *newRoute
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Updating the route should update account peers and send peer update when there is peers in group
-	t.Run("updating route", func(t *testing.T) {
-		baseRoute.Groups = []string{routeGroup1, routeGroup2}
-
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Deleting the route should update account peers and send peer update
-	t.Run("deleting route", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
-		require.NoError(t, err)
-
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
-
-	// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route peer groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.12.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
+			Peer:        peer1ID,
 			Description: "super",
 			Masquerade:  false,
 			Metric:      9999,
 			Enabled:     true,
 			Groups:      []string{routeGroup1},
 		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+		// Creating route should update account peers and send peer update
+		step(t, "creating route with a routing peer", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupB",
-			Name:  "GroupB",
-			Peers: []string{peer1ID},
+			newRoute, err := manager.CreateRoute(
+				context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer,
+				baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric,
+				baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+			baseRoute = *newRoute
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
-	})
+		// Updating the route should update account peers and send peer update when there is peers in group
+		step(t, "updating route", func(t *testing.T) {
+			baseRoute.Groups = []string{routeGroup1, routeGroup2}
 
-	// Adding peer to route groups that do not have any peers should update account peers and send peer update
-	t.Run("adding peer to route groups that do not have any peers", func(t *testing.T) {
-		newRoute := route.Route{
-			Network:     netip.MustParsePrefix("192.168.13.0/16"),
-			NetID:       "superNet",
-			NetworkType: route.IPv4Network,
-			PeerGroups:  []string{"groupB"},
-			Description: "super",
-			Masquerade:  false,
-			Metric:      9999,
-			Enabled:     true,
-			Groups:      []string{"groupC"},
-		}
-		_, err := manager.CreateRoute(
-			context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
-			newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
-			newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
-		)
-		require.NoError(t, err)
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
 
-		done := make(chan struct{})
-		go func() {
-			peerShouldReceiveUpdate(t, updMsg)
-			close(done)
-		}()
+			err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute)
+			require.NoError(t, err)
 
-		err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
-			ID:    "groupC",
-			Name:  "GroupC",
-			Peers: []string{peer1ID},
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
 		})
-		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(peerUpdateTimeout):
-			t.Error("timeout waiting for peerShouldReceiveUpdate")
-		}
+		// Deleting the route should update account peers and send peer update
+		step(t, "deleting route", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route peer groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route peer groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.12.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{routeGroup1},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupB",
+				Name:  "GroupB",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
+
+		// Adding peer to route groups that do not have any peers should update account peers and send peer update
+		step(t, "adding peer to route groups that do not have any peers", func(t *testing.T) {
+			newRoute := route.Route{
+				Network:     netip.MustParsePrefix("192.168.13.0/16"),
+				NetID:       "superNet",
+				NetworkType: route.IPv4Network,
+				PeerGroups:  []string{"groupB"},
+				Description: "super",
+				Masquerade:  false,
+				Metric:      9999,
+				Enabled:     true,
+				Groups:      []string{"groupC"},
+			}
+			_, err := manager.CreateRoute(
+				context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer,
+				newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric,
+				newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply,
+			)
+			require.NoError(t, err)
+
+			done := make(chan struct{})
+			go func() {
+				peerShouldReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{
+				ID:    "groupC",
+				Name:  "GroupC",
+				Peers: []string{peer1ID},
+			})
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(peerUpdateTimeout):
+				t.Error("timeout waiting for peerShouldReceiveUpdate")
+			}
+		})
 	})
 }
 

management/server/setupkey_test.go

@@ -397,75 +397,77 @@ func TestSetupKey_Copy(t *testing.T) {
 }
 
 func TestSetupKeyAccountPeersUpdate(t *testing.T) {
-	manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
+	runPeerUpdateTest(t, func(t *testing.T) {
+		manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t)
 
-	err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
-		ID:    "groupA",
-		Name:  "GroupA",
-		Peers: []string{peer1.ID, peer2.ID, peer3.ID},
-	})
-	assert.NoError(t, err)
-
-	policy := &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"groupA"},
-				Destinations:  []string{"group"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}
-	_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
-	require.NoError(t, err)
-
-	updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(context.Background(), peer1.ID)
-	})
-
-	// The setup policy above dispatches affected-peer updates asynchronously; drain
-	// any in-flight ones so the assertions only observe the setup-key operations.
-	settleAffectedUpdates(updMsg)
-
-	var setupKey *types.SetupKey
-
-	// Creating setup key should not update account peers and not send peer update
-	t.Run("creating setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+		err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{
+			ID:    "groupA",
+			Name:  "GroupA",
+			Peers: []string{peer1.ID, peer2.ID, peer3.ID},
+		})
 		assert.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+		policy := &types.Policy{
+			Enabled: true,
+			Rules: []*types.PolicyRule{
+				{
+					Enabled:       true,
+					Sources:       []string{"groupA"},
+					Destinations:  []string{"group"},
+					Bidirectional: true,
+					Action:        types.PolicyTrafficActionAccept,
+				},
+			},
 		}
-	})
-
-	// Saving setup key should not update account peers and not send peer update
-	t.Run("saving setup key", func(t *testing.T) {
-		done := make(chan struct{})
-		go func() {
-			peerShouldNotReceiveUpdate(t, updMsg)
-			close(done)
-		}()
-
-		_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+		_, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true)
 		require.NoError(t, err)
 
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("timeout waiting for peerShouldNotReceiveUpdate")
-		}
+		updMsg := updateManager.CreateChannel(context.Background(), peer1.ID)
+		t.Cleanup(func() {
+			updateManager.CloseChannel(context.Background(), peer1.ID)
+		})
+
+		// The setup policy above dispatches affected-peer updates asynchronously; drain
+		// any in-flight ones so the assertions only observe the setup-key operations.
+		settleAffectedUpdates(updMsg)
+
+		var setupKey *types.SetupKey
+
+		// Creating setup key should not update account peers and not send peer update
+		step(t, "creating setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false)
+			assert.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
+
+		// Saving setup key should not update account peers and not send peer update
+		step(t, "saving setup key", func(t *testing.T) {
+			done := make(chan struct{})
+			go func() {
+				peerShouldNotReceiveUpdate(t, updMsg)
+				close(done)
+			}()
+
+			_, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID)
+			require.NoError(t, err)
+
+			select {
+			case <-done:
+			case <-time.After(time.Second):
+				t.Error("timeout waiting for peerShouldNotReceiveUpdate")
+			}
+		})
 	})
 }
 

management/server/store/sql_store.go

@@ -2,25 +2,13 @@ package store
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"net/url"
-	"os"
-	"path/filepath"
-	"runtime"
-	"runtime/debug"
-	"strconv"
-	"strings"
 	"sync"
 	"time"
 
 	"github.com/jackc/pgx/v5/pgxpool"
 	log "github.com/sirupsen/logrus"
-	"gorm.io/driver/mysql"
-	"gorm.io/driver/postgres"
-	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
@@ -30,6 +18,7 @@ import (
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -42,7 +31,6 @@ import (
 )
 
 const (
-	storeSqliteFileName            = "store.db"
 	idQueryCondition               = "id = ?"
 	keyQueryCondition              = "key = ?"
 	mysqlKeyQueryCondition         = "`key` = ?"
@@ -52,71 +40,44 @@ const (
 	accountAndIDsQueryCondition    = "account_id = ? AND id IN ?"
 	accountIDCondition             = "account_id = ?"
 	peerNotFoundFMT                = "peer %s not found"
-
-	pgMaxConnections    = 30
-	pgMinConnections    = 1
-	pgMaxConnLifetime   = 60 * time.Minute
-	pgHealthCheckPeriod = 1 * time.Minute
 )
 
+var testPoolConfig = db.PoolConfig{
+	MaxConns:          5,
+	MinConns:          1,
+	MaxConnLifetime:   30 * time.Second,
+	HealthCheckPeriod: 10 * time.Second,
+}
+
 // SqlStore represents an account storage backed by a Sql DB persisted to disk
 type SqlStore struct {
-	db                 *gorm.DB
-	globalAccountLock  sync.Mutex
-	metrics            telemetry.AppMetrics
-	installationPK     int
-	storeEngine        types.Engine
-	pool               *pgxpool.Pool
-	fieldEncrypt       *crypt.FieldEncrypt
-	transactionTimeout time.Duration
+	conn              *db.Conn
+	db                *gorm.DB
+	tx                *db.Tx
+	globalAccountLock sync.Mutex
+	metrics           telemetry.AppMetrics
+	installationPK    int
+	fieldEncrypt      *crypt.FieldEncrypt
 }
 
 type migrationFunc func(*gorm.DB) error
 
-// NewSqlStore creates a new SqlStore instance.
-func NewSqlStore(ctx context.Context, db *gorm.DB, storeEngine types.Engine, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	sql, err := db.DB()
-	if err != nil {
-		return nil, err
+// NewSqlStore creates a new SqlStore instance on top of an open connection.
+func NewSqlStore(ctx context.Context, conn *db.Conn, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
+	if metrics != nil {
+		conn.SetTxMetrics(metrics.StoreMetrics())
 	}
-
-	conns, err := strconv.Atoi(os.Getenv("NB_SQL_MAX_OPEN_CONNS"))
-	if err != nil {
-		conns = runtime.NumCPU()
-	}
-
-	transactionTimeout := 5 * time.Minute
-	if v := os.Getenv("NB_STORE_TRANSACTION_TIMEOUT"); v != "" {
-		if parsed, err := time.ParseDuration(v); err == nil {
-			transactionTimeout = parsed
-		}
-	}
-	log.WithContext(ctx).Infof("Setting transaction timeout to %v", transactionTimeout)
-
-	if storeEngine == types.SqliteStoreEngine {
-		if err == nil {
-			log.WithContext(ctx).Warnf("setting NB_SQL_MAX_OPEN_CONNS is not supported for sqlite, using default value 1")
-		}
-		conns = 1
-	}
-
-	sql.SetMaxOpenConns(conns)
-	sql.SetMaxIdleConns(conns)
-	sql.SetConnMaxLifetime(time.Hour)
-	sql.SetConnMaxIdleTime(3 * time.Minute)
-
-	log.WithContext(ctx).Infof("Set max open db connections to %d, max idle to %d, max lifetime to %v, max idle time to %v",
-		conns, conns, time.Hour, 3*time.Minute)
+	store := &SqlStore{conn: conn, db: conn.DB(nil), metrics: metrics, installationPK: 1}
 
 	if skipMigration {
 		log.WithContext(ctx).Infof("skipping migration")
-		return &SqlStore{db: db, storeEngine: storeEngine, metrics: metrics, installationPK: 1, transactionTimeout: transactionTimeout}, nil
+		return store, nil
 	}
 
-	if err := migratePreAuto(ctx, db); err != nil {
+	if err := migratePreAuto(ctx, store.db); err != nil {
 		return nil, fmt.Errorf("migratePreAuto: %w", err)
 	}
-	err = db.AutoMigrate(
+	err := conn.AutoMigrate(
 		&types.SetupKey{}, &nbpeer.Peer{}, &types.User{}, &types.PersonalAccessToken{}, &types.ProxyAccessToken{},
 		&types.Group{}, &types.GroupPeer{},
 		&types.Account{}, &types.Policy{}, &types.PolicyRule{}, &route.Route{}, &nbdns.NameServerGroup{},
@@ -132,15 +93,34 @@ func NewSqlStore(ctx context.Context, db *gorm.DB, storeEngine types.Engine, met
 	if err != nil {
 		return nil, fmt.Errorf("auto migratePreAuto: %w", err)
 	}
-	if err := migratePostAuto(ctx, db); err != nil {
+	if err := migratePostAuto(ctx, store.db); err != nil {
 		return nil, fmt.Errorf("migratePostAuto: %w", err)
 	}
 
-	return &SqlStore{db: db, storeEngine: storeEngine, metrics: metrics, installationPK: 1, transactionTimeout: transactionTimeout}, nil
+	return store, nil
+}
+
+// newStore runs the migrations on conn and releases it when they fail.
+func newStore(ctx context.Context, conn *db.Conn, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
+	store, err := NewSqlStore(ctx, conn, metrics, skipMigration)
+	if err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	return store, nil
+}
+
+// Conn returns the shared connection so domain repositories can run alongside this store.
+func (s *SqlStore) Conn() *db.Conn {
+	return s.conn
+}
+
+func (s *SqlStore) pgxPool() *pgxpool.Pool {
+	return s.conn.Pool(s.tx)
 }
 
 func GetKeyQueryCondition(s *SqlStore) string {
-	if s.storeEngine == types.MysqlStoreEngine {
+	if s.conn.Engine() == db.MysqlStoreEngine {
 		return mysqlKeyQueryCondition
 	}
 	return keyQueryCondition
@@ -168,145 +148,39 @@ func (s *SqlStore) AcquireGlobalLock(ctx context.Context) (unlock func()) {
 
 // Close closes the underlying DB connection
 func (s *SqlStore) Close(_ context.Context) error {
-	sql, err := s.db.DB()
-	if err != nil {
-		return fmt.Errorf("get db: %w", err)
-	}
-	return sql.Close()
+	return s.conn.Close()
 }
 
 // GetStoreEngine returns underlying store engine
 func (s *SqlStore) GetStoreEngine() types.Engine {
-	return s.storeEngine
+	return s.conn.Engine()
 }
 
 // NewSqliteStore creates a new SQLite store.
 func NewSqliteStore(ctx context.Context, dataDir string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	storeFile := storeSqliteFileName
-	if envFile, ok := os.LookupEnv("NB_STORE_ENGINE_SQLITE_FILE"); ok && envFile != "" {
-		storeFile = envFile
-	}
-
-	// Separate file path from any SQLite URI query parameters (e.g., "store.db?mode=rwc")
-	filePath, query, hasQuery := strings.Cut(storeFile, "?")
-
-	connStr := filePath
-	if !filepath.IsAbs(filePath) {
-		connStr = filepath.Join(dataDir, filePath)
-	}
-
-	// Compose query parameters. User-provided ?_busy_timeout (or its mattn alias
-	// ?_timeout) overrides our default; otherwise inject 30s so SQLite waits at
-	// most that long on a lock instead of blocking the only Go-side connection.
-	// mattn/go-sqlite3 applies PRAGMA from the DSN on every fresh connection, so
-	// the value survives ConnMaxIdleTime/ConnMaxLifetime recycling. cache=shared
-	// stays the default on non-Windows for the same reason as before.
-	parsed, _ := url.ParseQuery(query)
-	var defaults []string
-	if parsed.Get("_busy_timeout") == "" && parsed.Get("_timeout") == "" {
-		defaults = append(defaults, "_busy_timeout=30000")
-	}
-	if !hasQuery && runtime.GOOS != "windows" {
-		// To avoid `The process cannot access the file because it is being used by another process` on Windows
-		defaults = append(defaults, "cache=shared")
-	}
-	parts := defaults
-	if hasQuery {
-		parts = append(parts, query)
-	}
-	if len(parts) > 0 {
-		connStr += "?" + strings.Join(parts, "&")
-	}
-
-	db, err := gorm.Open(sqlite.Open(connStr), getGormConfig())
+	conn, err := db.OpenSqlite(ctx, dataDir)
 	if err != nil {
 		return nil, err
 	}
-
-	return NewSqlStore(ctx, db, types.SqliteStoreEngine, metrics, skipMigration)
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewPostgresqlStore creates a new Postgres store.
 func NewPostgresqlStore(ctx context.Context, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	db, err := gorm.Open(postgres.Open(dsn), getGormConfig())
+	conn, err := db.OpenPostgres(ctx, dsn, db.DefaultPoolConfig)
 	if err != nil {
 		return nil, err
 	}
-	pool, err := connectToPgDb(context.Background(), dsn)
-	if err != nil {
-		return nil, err
-	}
-	store, err := NewSqlStore(ctx, db, types.PostgresStoreEngine, metrics, skipMigration)
-	if err != nil {
-		pool.Close()
-		return nil, err
-	}
-	store.pool = pool
-	return store, nil
-}
-
-func connectToPgDb(ctx context.Context, dsn string) (*pgxpool.Pool, error) {
-	config, err := pgxpool.ParseConfig(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse database config: %w", err)
-	}
-
-	config.MaxConns = pgMaxConnections
-	config.MinConns = pgMinConnections
-	config.MaxConnLifetime = pgMaxConnLifetime
-	config.HealthCheckPeriod = pgHealthCheckPeriod
-
-	pool, err := pgxpool.NewWithConfig(ctx, config)
-	if err != nil {
-		return nil, fmt.Errorf("unable to create connection pool: %w", err)
-	}
-
-	if err := pool.Ping(ctx); err != nil {
-		pool.Close()
-		return nil, fmt.Errorf("unable to ping database: %w", err)
-	}
-
-	return pool, nil
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewMysqlStore creates a new MySQL store.
 func NewMysqlStore(ctx context.Context, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	db, err := gorm.Open(mysql.Open(dsn+"?charset=utf8&parseTime=True&loc=Local"), getGormConfig())
+	conn, err := db.OpenMysql(ctx, dsn)
 	if err != nil {
 		return nil, err
 	}
-
-	store, err := NewSqlStore(ctx, db, types.MysqlStoreEngine, metrics, skipMigration)
-	if err != nil {
-		closeGormDB(db)
-		return nil, err
-	}
-	return store, nil
-}
-
-func getGormConfig() *gorm.Config {
-	return &gorm.Config{
-		Logger:          logger.Default.LogMode(logger.Silent),
-		CreateBatchSize: 400,
-	}
-}
-
-// newPostgresStore initializes a new Postgres store.
-func newPostgresStore(ctx context.Context, metrics telemetry.AppMetrics, skipMigration bool) (Store, error) {
-	dsn, ok := lookupDSNEnv(PostgresDsnEnv, PostgresDsnEnvLegacy)
-	if !ok {
-		return nil, fmt.Errorf("%s is not set", PostgresDsnEnv)
-	}
-	return NewPostgresqlStore(ctx, dsn, metrics, skipMigration)
-}
-
-// newMysqlStore initializes a new MySQL store.
-func newMysqlStore(ctx context.Context, metrics telemetry.AppMetrics, skipMigration bool) (Store, error) {
-	dsn, ok := lookupDSNEnv(mysqlDsnEnv, mysqlDsnEnvLegacy)
-	if !ok {
-		return nil, fmt.Errorf("%s is not set", mysqlDsnEnv)
-	}
-	return NewMysqlStore(ctx, dsn, metrics, skipMigration)
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewSqliteStoreFromFileStore restores a store from FileStore and stores SQLite DB in the file located in datadir.
@@ -350,7 +224,7 @@ func newPostgresqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore,
 	}
 
 	if err := seedFromSqliteStore(ctx, store, sqliteStore); err != nil {
-		closeStore(ctx, store)
+		_ = store.Close(ctx)
 		return nil, err
 	}
 
@@ -359,49 +233,11 @@ func newPostgresqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore,
 
 // used for tests only
 func NewPostgresqlStoreForTests(ctx context.Context, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
-	db, err := gorm.Open(postgres.Open(dsn), getGormConfig())
+	conn, err := db.OpenPostgres(ctx, dsn, testPoolConfig)
 	if err != nil {
 		return nil, err
 	}
-	pool, err := connectToPgDbForTests(context.Background(), dsn)
-	if err != nil {
-		closeGormDB(db)
-		return nil, err
-	}
-	store, err := NewSqlStore(ctx, db, types.PostgresStoreEngine, metrics, skipMigration)
-	if err != nil {
-		// Release the sessions, or the caller cannot drop the database.
-		pool.Close()
-		closeGormDB(db)
-		return nil, err
-	}
-	store.pool = pool
-	return store, nil
-}
-
-// used for tests only
-func connectToPgDbForTests(ctx context.Context, dsn string) (*pgxpool.Pool, error) {
-	config, err := pgxpool.ParseConfig(dsn)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse database config: %w", err)
-	}
-
-	config.MaxConns = 5
-	config.MinConns = 1
-	config.MaxConnLifetime = 30 * time.Second
-	config.HealthCheckPeriod = 10 * time.Second
-
-	pool, err := pgxpool.NewWithConfig(ctx, config)
-	if err != nil {
-		return nil, fmt.Errorf("unable to create connection pool: %w", err)
-	}
-
-	if err := pool.Ping(ctx); err != nil {
-		pool.Close()
-		return nil, fmt.Errorf("unable to ping database: %w", err)
-	}
-
-	return pool, nil
+	return newStore(ctx, conn, metrics, skipMigration)
 }
 
 // NewMysqlStoreFromSqlStore restores a store from SqlStore and stores MySQL DB.
@@ -423,15 +259,6 @@ func seedFromSqliteStore(ctx context.Context, store, sqliteStore *SqlStore) erro
 	return nil
 }
 
-// closeStore releases a store that is not handed to the caller, so a failed
-// seed does not leak its connection and pool.
-func closeStore(ctx context.Context, store *SqlStore) {
-	store.Close(ctx)
-	if store.pool != nil {
-		store.pool.Close()
-	}
-}
-
 func newMysqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore, dsn string, metrics telemetry.AppMetrics, skipMigration bool) (*SqlStore, error) {
 	store, err := NewMysqlStore(ctx, dsn, metrics, skipMigration)
 	if err != nil {
@@ -439,113 +266,41 @@ func newMysqlStoreFromSqlStore(ctx context.Context, sqliteStore *SqlStore, dsn s
 	}
 
 	if err := seedFromSqliteStore(ctx, store, sqliteStore); err != nil {
-		closeStore(ctx, store)
+		_ = store.Close(ctx)
 		return nil, err
 	}
 
 	return store, nil
 }
 
+// ExecuteInTransaction runs operation in a transaction. A store that is already
+// bound to one joins it instead of opening a second, independent transaction.
 func (s *SqlStore) ExecuteInTransaction(ctx context.Context, operation func(store Store) error) error {
-	timeoutCtx, cancel := context.WithTimeout(ctx, s.transactionTimeout)
-	defer cancel()
-
-	startTime := time.Now()
-	tx := s.db.WithContext(timeoutCtx).Begin()
-	if tx.Error != nil {
-		return tx.Error
+	if s.tx != nil {
+		return operation(s)
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			tx.Rollback()
-			panic(r)
-		}
-	}()
-
-	if s.storeEngine == types.PostgresStoreEngine {
-		if err := tx.Exec("SET LOCAL statement_timeout = '1min'").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to set statement timeout: %w", err)
-		}
-		if err := tx.Exec("SET LOCAL lock_timeout = '1min'").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to set lock timeout: %w", err)
-		}
-	}
-
-	// For MySQL, disable FK checks within this transaction to avoid deadlocks
-	// This is session-scoped and doesn't require SUPER privileges
-	if s.storeEngine == types.MysqlStoreEngine {
-		if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 0").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to disable FK checks: %w", err)
-		}
-	}
-
-	repo := s.withTx(tx)
-	err := operation(repo)
-	if err != nil {
-		tx.Rollback()
-		if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) {
-			log.WithContext(ctx).Warnf("transaction exceeded %s timeout after %v, stack: %s", s.transactionTimeout, time.Since(startTime), debug.Stack())
-		}
-		return err
-	}
-
-	// Re-enable FK checks before commit (optional, as transaction end resets it)
-	if s.storeEngine == types.MysqlStoreEngine {
-		if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 1").Error; err != nil {
-			tx.Rollback()
-			return fmt.Errorf("failed to re-enable FK checks: %w", err)
-		}
-	}
-
-	err = tx.Commit().Error
-	if err != nil {
-		if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) {
-			log.WithContext(ctx).Warnf("transaction commit exceeded %s timeout after %v, stack: %s", s.transactionTimeout, time.Since(startTime), debug.Stack())
-		}
-		return err
-	}
-
-	log.WithContext(ctx).Tracef("transaction took %v", time.Since(startTime))
-	if s.metrics != nil {
-		s.metrics.StoreMetrics().CountTransactionDuration(time.Since(startTime))
-	}
-
-	return nil
+	return s.conn.RunInTx(ctx, func(tx *db.Tx) error {
+		return operation(s.withTx(tx))
+	})
 }
 
-func (s *SqlStore) withTx(tx *gorm.DB) Store {
+func (s *SqlStore) withTx(tx *db.Tx) Store {
 	return &SqlStore{
-		db:           tx,
-		storeEngine:  s.storeEngine,
+		conn:         s.conn,
+		db:           s.conn.DB(tx),
+		tx:           tx,
 		fieldEncrypt: s.fieldEncrypt,
 	}
 }
 
-// transaction wraps a GORM transaction with MySQL-specific FK checks handling
-// Use this instead of db.Transaction() directly to avoid deadlocks on MySQL/Aurora
-func (s *SqlStore) transaction(fn func(*gorm.DB) error) error {
-	return s.db.Transaction(func(tx *gorm.DB) error {
-		// For MySQL, disable FK checks within this transaction to avoid deadlocks
-		// This is session-scoped and doesn't require SUPER privileges
-		if s.storeEngine == types.MysqlStoreEngine {
-			if err := tx.Exec("SET FOREIGN_KEY_CHECKS = 0").Error; err != nil {
-				return fmt.Errorf("failed to disable FK checks: %w", err)
-			}
-		}
-
-		err := fn(tx)
-
-		// Re-enable FK checks before commit (optional, as transaction end resets it)
-		if s.storeEngine == types.MysqlStoreEngine && err == nil {
-			if fkErr := tx.Exec("SET FOREIGN_KEY_CHECKS = 1").Error; fkErr != nil {
-				return fmt.Errorf("failed to re-enable FK checks: %w", fkErr)
-			}
-		}
-
-		return err
+// transaction runs fn as a savepoint of the bound transaction, or in a new
+// transaction when the store is not bound to one.
+func (s *SqlStore) transaction(ctx context.Context, fn func(tx *gorm.DB) error) error {
+	if s.tx != nil {
+		return s.db.Transaction(fn)
+	}
+	return s.conn.RunInTx(ctx, func(tx *db.Tx) error {
+		return fn(s.conn.DB(tx))
 	})
 }
 

management/server/store/sql_store_access_log.go

@@ -1,149 +0,0 @@
-package store
-
-import (
-	"context"
-	"strings"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// CreateAccessLog creates a new access log entry in the database
-func (s *SqlStore) CreateAccessLog(ctx context.Context, logEntry *accesslogs.AccessLogEntry) error {
-	result := s.db.Create(logEntry)
-	if result.Error != nil {
-		log.WithContext(ctx).WithFields(log.Fields{
-			"service_id": logEntry.ServiceID,
-			"method":     logEntry.Method,
-			"host":       logEntry.Host,
-			"path":       logEntry.Path,
-		}).Errorf("failed to create access log entry in store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to create access log entry in store")
-	}
-	return nil
-}
-
-// GetAccountAccessLogs retrieves access logs for a given account with pagination and filtering
-func (s *SqlStore) GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
-	var logs []*accesslogs.AccessLogEntry
-	var totalCount int64
-
-	baseQuery := s.db.
-		Model(&accesslogs.AccessLogEntry{}).
-		Where(accountIDCondition, accountID)
-
-	baseQuery = s.applyAccessLogFilters(baseQuery, filter)
-
-	if err := baseQuery.Count(&totalCount).Error; err != nil {
-		log.WithContext(ctx).Errorf("failed to count access logs: %v", err)
-		return nil, 0, status.Errorf(status.Internal, "failed to count access logs")
-	}
-
-	query := s.db.
-		Where(accountIDCondition, accountID)
-
-	query = s.applyAccessLogFilters(query, filter)
-
-	sortColumns := filter.GetSortColumn()
-	sortOrder := strings.ToUpper(filter.GetSortOrder())
-
-	var orderClauses []string
-	for _, col := range strings.Split(sortColumns, ",") {
-		col = strings.TrimSpace(col)
-		if col != "" {
-			orderClauses = append(orderClauses, col+" "+sortOrder)
-		}
-	}
-	orderClause := strings.Join(orderClauses, ", ")
-
-	query = query.
-		Order(orderClause).
-		Limit(filter.GetLimit()).
-		Offset(filter.GetOffset())
-
-	if lockStrength != LockingStrengthNone {
-		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	result := query.Find(&logs)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get access logs from store: %v", result.Error)
-		return nil, 0, status.Errorf(status.Internal, "failed to get access logs from store")
-	}
-
-	return logs, totalCount, nil
-}
-
-// DeleteOldAccessLogs deletes all access logs older than the specified time
-func (s *SqlStore) DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error) {
-	result := s.db.
-		Where("timestamp < ?", olderThan).
-		Delete(&accesslogs.AccessLogEntry{})
-
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete old access logs: %v", result.Error)
-		return 0, status.Errorf(status.Internal, "failed to delete old access logs")
-	}
-
-	return result.RowsAffected, nil
-}
-
-// applyAccessLogFilters applies filter conditions to the query
-func (s *SqlStore) applyAccessLogFilters(query *gorm.DB, filter accesslogs.AccessLogFilter) *gorm.DB {
-	if filter.Search != nil {
-		searchPattern := "%" + *filter.Search + "%"
-		query = query.Where(
-			"id LIKE ? OR location_connection_ip LIKE ? OR host LIKE ? OR path LIKE ? OR CONCAT(host, path) LIKE ? OR user_id IN (SELECT id FROM users WHERE email LIKE ? OR name LIKE ?)",
-			searchPattern, searchPattern, searchPattern, searchPattern, searchPattern, searchPattern, searchPattern,
-		)
-	}
-
-	if filter.SourceIP != nil {
-		query = query.Where("location_connection_ip = ?", *filter.SourceIP)
-	}
-
-	if filter.Host != nil {
-		query = query.Where("host = ?", *filter.Host)
-	}
-
-	if filter.Path != nil {
-		// Support LIKE pattern for path filtering
-		query = query.Where("path LIKE ?", "%"+*filter.Path+"%")
-	}
-
-	if filter.UserID != nil {
-		query = query.Where("user_id = ?", *filter.UserID)
-	}
-
-	if filter.Method != nil {
-		query = query.Where("method = ?", *filter.Method)
-	}
-
-	if filter.Status != nil {
-		switch *filter.Status {
-		case "success":
-			query = query.Where("status_code >= ? AND status_code < ?", 200, 400)
-		case "failed":
-			query = query.Where("status_code < ? OR status_code >= ?", 200, 400)
-		}
-	}
-
-	if filter.StatusCode != nil {
-		query = query.Where("status_code = ?", *filter.StatusCode)
-	}
-
-	if filter.StartDate != nil {
-		query = query.Where("timestamp >= ?", *filter.StartDate)
-	}
-
-	if filter.EndDate != nil {
-		query = query.Where("timestamp <= ?", *filter.EndDate)
-	}
-
-	return query
-}

management/server/store/sql_store_account.go

@@ -18,6 +18,7 @@ import (
 	"gorm.io/gorm/clause"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/route"
@@ -51,7 +52,7 @@ func (s *SqlStore) SaveAccount(ctx context.Context, account *types.Account) erro
 		group.StoreGroupPeers()
 	}
 
-	err := s.transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		result := tx.Select(clause.Associations).Delete(account.Policies, "account_id = ?", account.Id)
 		if result.Error != nil {
 			return result.Error
@@ -146,7 +147,7 @@ func (s *SqlStore) checkAccountDomainBeforeSave(ctx context.Context, accountID,
 func (s *SqlStore) DeleteAccount(ctx context.Context, account *types.Account) error {
 	start := time.Now()
 
-	err := s.transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		result := tx.Select(clause.Associations).Delete(account.Policies, "account_id = ?", account.Id)
 		if result.Error != nil {
 			return result.Error
@@ -162,6 +163,10 @@ func (s *SqlStore) DeleteAccount(ctx context.Context, account *types.Account) er
 			return result.Error
 		}
 
+		if err := deleteAgentNetworkAccountConfig(tx, account.Id); err != nil {
+			return err
+		}
+
 		result = tx.Select(clause.Associations).Delete(account)
 		if result.Error != nil {
 			return result.Error
@@ -179,6 +184,29 @@ func (s *SqlStore) DeleteAccount(ctx context.Context, account *types.Account) er
 	return err
 }
 
+// deleteAgentNetworkAccountConfig removes the account's agent network configuration. These
+// tables are not account associations, so deleting the account does not reach them. The
+// settings row holds the account's globally unique gateway domain and the provider rows
+// hold its upstream API keys. Tables that grow with traffic are left out: consumption
+// counters and access logs are swept in the background, and usage records are kept.
+func deleteAgentNetworkAccountConfig(tx *gorm.DB, accountID string) error {
+	// Dependents first: policies point at providers and guardrails, and settings
+	// go last, as DeleteSettings refuses while providers exist.
+	models := []any{
+		&agentNetworkTypes.Policy{},
+		&agentNetworkTypes.Provider{},
+		&agentNetworkTypes.Guardrail{},
+		&agentNetworkTypes.AccountBudgetRule{},
+		&agentNetworkTypes.Settings{},
+	}
+	for _, model := range models {
+		if err := tx.Delete(model, "account_id = ?", accountID).Error; err != nil {
+			return fmt.Errorf("delete %T rows: %w", model, err)
+		}
+	}
+	return nil
+}
+
 func (s *SqlStore) UpdateAccountDomainAttributes(ctx context.Context, accountID string, domain string, category string, isPrimaryDomain bool) error {
 	accountCopy := types.Account{
 		Domain:                 domain,
@@ -281,7 +309,7 @@ func (s *SqlStore) GetAccountMeta(ctx context.Context, lockStrength LockingStren
 }
 
 func (s *SqlStore) GetAccount(ctx context.Context, accountID string) (*types.Account, error) {
-	if s.pool != nil {
+	if s.pgxPool() != nil {
 		return s.getAccountPgx(ctx, accountID)
 	}
 	return s.getAccountGorm(ctx, accountID)
@@ -763,7 +791,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		networkSerial                    sql.NullInt64
 		createdAt                        sql.NullTime
 	)
-	err := s.pool.QueryRow(ctx, accountQuery, accountID).Scan(
+	err := s.pgxPool().QueryRow(ctx, accountQuery, accountID).Scan(
 		&account.Id, &account.CreatedBy, &createdAt, &account.Domain, &account.DomainCategory, &account.IsDomainPrimaryAccount,
 		&networkIdentifier, &networkNet, &networkNetV6, &networkDns, &networkSerial,
 		&dnsSettingsDisabledGroups,

management/server/store/sql_store_account_onboarding.go

@@ -44,7 +44,7 @@ func (s *SqlStore) getAccountOnboarding(ctx context.Context, accountID string, a
 	const query = `SELECT account_id, onboarding_flow_pending, signup_form_pending, created_at, updated_at FROM account_onboardings WHERE account_id = $1`
 	var onboardingFlowPending, signupFormPending sql.NullBool
 	var createdAt, updatedAt sql.NullTime
-	err := s.pool.QueryRow(ctx, query, accountID).Scan(
+	err := s.pgxPool().QueryRow(ctx, query, accountID).Scan(
 		&account.Onboarding.AccountID,
 		&onboardingFlowPending,
 		&signupFormPending,

management/server/store/sql_store_account_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
@@ -401,6 +402,25 @@ func TestSqlite_DeleteAccount(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, o.AccountID, account.Id)
 
+	err = store.CreateAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
+		AccountID:    account.Id,
+		Domain:       "gw.example.com",
+		ProxyAddress: "gw.example.com",
+	})
+	require.NoError(t, err)
+
+	agentNetworkConfig := []any{
+		&agentNetworkTypes.Provider{ID: "an_provider", AccountID: account.Id, APIKey: "sk-test"},
+		&agentNetworkTypes.Policy{ID: "an_policy", AccountID: account.Id},
+		&agentNetworkTypes.Guardrail{ID: "an_guardrail", AccountID: account.Id},
+		&agentNetworkTypes.AccountBudgetRule{ID: "an_budget_rule", AccountID: account.Id},
+	}
+	for _, row := range agentNetworkConfig {
+		require.NoError(t, store.(*SqlStore).db.Create(row).Error, "creating %T", row)
+	}
+	otherProvider := &agentNetworkTypes.Provider{ID: "other_provider", AccountID: "other_account"}
+	require.NoError(t, store.(*SqlStore).db.Create(otherProvider).Error)
+
 	err = store.DeleteAccount(context.Background(), account)
 	require.NoError(t, err)
 
@@ -465,6 +485,32 @@ func TestSqlite_DeleteAccount(t *testing.T) {
 	err = store.(*SqlStore).db.Model(&rpservice.Target{}).Find(&targets, "account_id = ?", account.Id).Error
 	require.NoError(t, err, "expecting no error after DeleteAccount when searching for service targets")
 	require.Len(t, targets, 0, "expecting no service targets to be found after DeleteAccount")
+
+	_, err = store.GetAgentNetworkSettings(context.Background(), LockingStrengthNone, account.Id)
+	require.Error(t, err, "expecting agent network settings to be deleted with the account")
+	sErr, ok := status.FromError(err)
+	require.True(t, ok, "expecting a status error when getting agent network settings, got %v", err)
+	require.Equal(t, status.NotFound, sErr.Type(), "expecting agent network settings to be deleted with the account")
+
+	// The domain is globally unique, so a leftover row would keep it from another account.
+	err = store.CreateAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
+		AccountID:    "other_account",
+		Domain:       "gw.example.com",
+		ProxyAddress: "gw.example.com",
+	})
+	require.NoError(t, err, "expecting the deleted account's gateway domain to be free for another account")
+
+	for _, row := range agentNetworkConfig {
+		var count int64
+		err = store.(*SqlStore).db.Model(row).Where("account_id = ?", account.Id).Count(&count).Error
+		require.NoError(t, err, "counting %T rows after DeleteAccount", row)
+		assert.Zero(t, count, "expecting no %T rows to be found after DeleteAccount", row)
+	}
+
+	var otherProviders int64
+	err = store.(*SqlStore).db.Model(&agentNetworkTypes.Provider{}).Where("account_id = ?", "other_account").Count(&otherProviders).Error
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), otherProviders, "expecting another account's agent network provider to survive DeleteAccount")
 }
 
 func Test_GetAccount(t *testing.T) {

management/server/store/sql_store_agent_network_access_log.go

@@ -16,7 +16,7 @@ import (
 // entry together with its authorising-group child rows in a single
 // transaction.
 func (s *SqlStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
-	err := s.db.Transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		// Idempotent on the log id / (log_id, group_id) so a proxy resend of the
 		// same entry can't fail the request.
 		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(entry).Error; err != nil {
@@ -46,7 +46,7 @@ func (s *SqlStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agent
 // deleted.
 func (s *SqlStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
 	var deleted int64
-	err := s.db.Transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		// Remove group child rows for the soon-to-be-deleted logs first.
 		if err := tx.Exec(
 			"DELETE FROM agent_network_access_log_group WHERE account_id = ? AND log_id IN (SELECT id FROM agent_network_access_log WHERE account_id = ? AND timestamp < ?)",
@@ -69,6 +69,23 @@ func (s *SqlStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountI
 	return deleted, nil
 }
 
+// GetDeletedAccountIDsWithAgentNetworkAccessLogs returns the IDs of accounts that no
+// longer exist but still have access-log rows. The retention sweep is driven by settings
+// rows, which are deleted with the account, so it uses this to find logs it would
+// otherwise never expire.
+func (s *SqlStore) GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx context.Context) ([]string, error) {
+	var accountIDs []string
+	err := s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).
+		Distinct("account_id").
+		Where("NOT EXISTS (SELECT 1 FROM accounts WHERE accounts.id = agent_network_access_log.account_id)").
+		Pluck("account_id", &accountIDs).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get deleted accounts with agent-network access logs: %v", err)
+		return nil, status.Errorf(status.Internal, "failed to get deleted accounts with agent-network access logs")
+	}
+	return accountIDs, nil
+}
+
 // GetAgentNetworkAccessLogs retrieves flattened agent-network access logs for
 // an account with server-side pagination, filtering and sorting. Authorising
 // group ids are hydrated from the group child table for the returned page.

management/server/store/sql_store_agent_network_usage.go

@@ -14,7 +14,7 @@ import (
 // CreateAgentNetworkUsage persists a stripped agent-network usage record
 // together with its authorising-group child rows in a single transaction.
 func (s *SqlStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
-	err := s.db.Transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		// Idempotent on the usage id / (usage_id, group_id) so a proxy resend of
 		// the same entry can't fail the request.
 		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(usage).Error; err != nil {

management/server/store/sql_store_agentnetwork.go

@@ -619,7 +619,7 @@ func (s *SqlStore) IncrementAgentNetworkConsumptionBatch(
 	}
 
 	const tbl = "agent_network_consumption"
-	err := s.db.Transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		for _, k := range keys {
 			if k.DimID == "" || k.WindowSeconds <= 0 {
 				return status.Errorf(status.InvalidArgument, "dim_id and window_seconds must be set")
@@ -663,6 +663,21 @@ func (s *SqlStore) IncrementAgentNetworkConsumptionBatch(
 	return nil
 }
 
+// DeleteAgentNetworkConsumptionOfDeletedAccounts deletes every consumption counter whose
+// account no longer exists and returns the number of rows deleted. Counters grow with
+// traffic, so they are swept in the background instead of in the account-deletion
+// transaction, and the sweep also catches counters a proxy writes after the deletion.
+func (s *SqlStore) DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx context.Context) (int64, error) {
+	res := s.db.
+		Where("NOT EXISTS (SELECT 1 FROM accounts WHERE accounts.id = agent_network_consumption.account_id)").
+		Delete(&agentNetworkTypes.Consumption{})
+	if res.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent-network consumption of deleted accounts: %v", res.Error)
+		return 0, status.Errorf(status.Internal, "failed to delete agent-network consumption of deleted accounts")
+	}
+	return res.RowsAffected, nil
+}
+
 // ListAgentNetworkConsumption returns every consumption row recorded
 // for the account, ordered by window_start descending. Backs the
 // dashboard's basic counter view.

management/server/store/sql_store_agentnetwork_accesslog_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/types"
 )
 
 // TestAgentNetworkUsage_RealStore_RoundTrip drives CreateAgentNetworkUsage and
@@ -300,3 +301,37 @@ func TestDeleteOldAgentNetworkAccessLogs(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, usage, 1, "usage record for the deleted log must survive")
 }
+
+// TestDeleteAgentNetworkConsumptionOfDeletedAccounts verifies that the sweep removes the
+// consumption counters of accounts that no longer exist and leaves live accounts' counters,
+// including those of a live account without a settings row.
+func TestDeleteAgentNetworkConsumptionOfDeletedAccounts(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, s Store) {
+		ctx := context.Background()
+		const (
+			liveAccountID    = "acc-anet-consumption-live"
+			deletedAccountID = "acc-anet-consumption-deleted"
+		)
+		require.NoError(t, s.SaveAccount(ctx, &types.Account{Id: liveAccountID}))
+
+		windowStart := time.Now().UTC().Truncate(time.Hour)
+		for _, accountID := range []string{liveAccountID, deletedAccountID} {
+			for _, dimID := range []string{"user-1", "user-2"} {
+				require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, accountID,
+					agentNetworkTypes.DimensionUser, dimID, 3600, windowStart, 10, 5, 0.01))
+			}
+		}
+
+		deleted, err := s.DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, int64(2), deleted, "both of the deleted account's counters should be removed")
+
+		rows, err := s.ListAgentNetworkConsumption(ctx, LockingStrengthNone, deletedAccountID)
+		require.NoError(t, err)
+		assert.Empty(t, rows, "the deleted account should have no consumption counters left")
+
+		rows, err = s.ListAgentNetworkConsumption(ctx, LockingStrengthNone, liveAccountID)
+		require.NoError(t, err)
+		assert.Len(t, rows, 2, "the live account's consumption counters should survive")
+	})
+}

management/server/store/sql_store_custom_domain.go

@@ -4,13 +4,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -131,16 +134,45 @@ func (s *SqlStore) UpdateCustomDomain(ctx context.Context, accountID string, d *
 	return d, nil
 }
 
-func (s *SqlStore) DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error {
-	result := s.db.Delete(domain.Domain{}, accountAndIDQueryCondition, accountID, domainID)
-	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to delete reverse proxy custom domain from store: %v", result.Error)
-		return status.Errorf(status.Internal, "failed to delete reverse proxy custom domain from store")
+// LockCustomDomains holds shared locks on registrations covering a service until commit.
+func (s *SqlStore) LockCustomDomains(ctx context.Context, accountID string, serviceDomain nbdomain.Domain) ([]*domain.Domain, error) {
+	var names []string
+	for name := serviceDomain.PunycodeString(); name != ""; {
+		names = append(names, name)
+		_, name, _ = strings.Cut(name, ".")
 	}
 
-	if result.RowsAffected == 0 {
-		return status.Errorf(status.NotFound, "reverse proxy custom domain %s not found", domainID)
+	var domains []*domain.Domain
+	if err := s.db.WithContext(ctx).Clauses(clause.Locking{Strength: string(LockingStrengthShare)}).
+		Where(accountIDCondition, accountID).Where("domain IN ?", names).
+		Order("id").Find(&domains).Error; err != nil {
+		return nil, fmt.Errorf("lock custom domains: %w", err)
 	}
+	return domains, nil
+}
 
-	return nil
+// DeleteCustomDomain removes a registration only when no service uses its namespace.
+func (s *SqlStore) DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error {
+	return s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var d domain.Domain
+		// Service writes hold a shared lock on this row through commit, so neither
+		// operation can proceed against the other's outdated view of the domain.
+		if err := tx.Clauses(clause.Locking{Strength: string(LockingStrengthUpdate)}).
+			Take(&d, accountAndIDQueryCondition, accountID, domainID).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return status.Errorf(status.NotFound, "custom domain not found")
+			}
+			return fmt.Errorf("lock custom domain for deletion: %w", err)
+		}
+
+		result := tx.Where(accountAndIDQueryCondition, accountID, domainID).
+			Where("NOT EXISTS (?)", customDomainServices(tx, &d).Select("1")).Delete(&domain.Domain{})
+		if result.Error != nil {
+			return fmt.Errorf("delete custom domain: %w", result.Error)
+		}
+		if result.RowsAffected == 0 {
+			return status.Errorf(status.PreconditionFailed, "custom domain has dependent services; delete or move them before deleting the domain")
+		}
+		return nil
+	})
 }

management/server/store/sql_store_custom_domain_test.go

@@ -0,0 +1,182 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/types"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+func TestLockCustomDomains_ConcurrentServices(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		if store.GetStoreEngine() == types.SqliteStoreEngine {
+			t.Skip("SQLite serializes transactions on one connection")
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		_, err := store.CreateCustomDomain(ctx, "owner", "one.example.com", "cluster", true)
+		require.NoError(t, err)
+		_, err = store.CreateCustomDomain(ctx, "owner", "two.example.com", "cluster", true)
+		require.NoError(t, err)
+
+		locked := make(chan error, 1)
+		release := make(chan struct{})
+		done := make(chan error, 1)
+		go func() {
+			done <- store.ExecuteInTransaction(ctx, func(tx Store) error {
+				_, err := tx.LockCustomDomains(ctx, "owner", "app.one.example.com")
+				locked <- err
+				if err != nil {
+					return err
+				}
+				select {
+				case <-release:
+					return nil
+				case <-ctx.Done():
+					return ctx.Err()
+				}
+			})
+		}()
+		var lockErr error
+		select {
+		case lockErr = <-locked:
+		case err := <-done:
+			t.Fatalf("transaction ended before locking: %v", err)
+		}
+		writeCtx, writeCancel := context.WithTimeout(ctx, 3*time.Second)
+		defer writeCancel()
+		var writeErr error
+		for _, name := range []nbdomain.Domain{"app.one.example.com", "app.two.example.com"} {
+			writeErr = store.ExecuteInTransaction(writeCtx, func(tx Store) error {
+				if _, err := tx.LockCustomDomains(writeCtx, "owner", name); err != nil {
+					return err
+				}
+				return tx.CreateService(writeCtx, &rpservice.Service{
+					ID: name.PunycodeString(), AccountID: "owner", Domain: name.PunycodeString(),
+				})
+			})
+			if writeErr != nil {
+				break
+			}
+		}
+		close(release)
+		require.NoError(t, <-done)
+		require.NoError(t, lockErr)
+		require.NoError(t, writeErr, "domain authorization locks must allow concurrent service writes")
+		services, err := store.GetAccountServices(ctx, LockingStrengthNone, "owner")
+		require.NoError(t, err)
+		assert.Len(t, services, 2, "both services must commit while the first domain is locked")
+	})
+}
+
+func TestDeleteCustomDomain_ServiceDependencies(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		d, err := store.CreateCustomDomain(ctx, "owner", "example.com", "cluster", true)
+		require.NoError(t, err)
+		svc := &rpservice.Service{ID: "service", AccountID: "owner", Domain: "APP.EXAMPLE.COM."}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		err = store.DeleteCustomDomain(ctx, "other", d.ID)
+		require.Error(t, err)
+		sErr, ok := status.FromError(err)
+		require.True(t, ok, "cross-account deletion must return a typed error")
+		assert.Equal(t, status.NotFound, sErr.Type(), "cross-account deletion must not reveal dependencies")
+
+		err = store.DeleteCustomDomain(ctx, "owner", d.ID)
+		require.Error(t, err)
+		sErr, ok = status.FromError(err)
+		require.True(t, ok, "dependent services must return a typed error")
+		assert.Equal(t, status.PreconditionFailed, sErr.Type(), "deletion must fail until services are removed")
+		stored, err := store.GetCustomDomain(ctx, "owner", d.ID)
+		require.NoError(t, err)
+		assert.True(t, stored.Validated, "rejected deletion must preserve validation")
+
+		require.NoError(t, store.DeleteService(ctx, "owner", svc.ID))
+		require.NoError(t, store.DeleteCustomDomain(ctx, "owner", d.ID))
+		_, err = store.GetCustomDomain(ctx, "owner", d.ID)
+		require.Error(t, err, "the registration must be gone after successful deletion")
+	})
+}
+
+func TestDeleteCustomDomain_OtherAccountSubdomainIsNotADependency(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "other", "admin", "")))
+
+		// Registrations are unique by name, so a second account can hold a
+		// subdomain of the first account's registration and serve from it.
+		parent, err := store.CreateCustomDomain(ctx, "owner", "example.com", "cluster", true)
+		require.NoError(t, err)
+		_, err = store.CreateCustomDomain(ctx, "other", "team.example.com", "cluster", true)
+		require.NoError(t, err)
+		require.NoError(t, store.CreateService(ctx, &rpservice.Service{
+			ID: "service", AccountID: "other", Domain: "app.team.example.com",
+		}))
+
+		require.NoError(t, store.DeleteCustomDomain(ctx, "owner", parent.ID),
+			"another account's service must not hold the registration open")
+	})
+}
+
+func TestDeleteCustomDomain_ConcurrentServiceCreation(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, "owner", "admin", "")))
+		for i := range 10 {
+			d, err := store.CreateCustomDomain(ctx, "owner", fmt.Sprintf("app%d.example.com", i), "cluster", true)
+			require.NoError(t, err)
+			svc := &rpservice.Service{ID: fmt.Sprintf("service-%d", i), AccountID: "owner", Domain: "nested." + d.Domain}
+			start := make(chan struct{})
+			created := make(chan error, 1)
+			deleted := make(chan error, 1)
+			go func() {
+				<-start
+				created <- store.ExecuteInTransaction(ctx, func(tx Store) error {
+					domains, err := tx.LockCustomDomains(ctx, "owner", nbdomain.Domain(svc.Domain))
+					if err != nil {
+						return err
+					}
+					for _, candidate := range domains {
+						if candidate.ID == d.ID && candidate.Validated {
+							return tx.CreateService(ctx, svc)
+						}
+					}
+					return status.Errorf(status.PreconditionFailed, "registration was deleted")
+				})
+			}()
+			go func() {
+				<-start
+				deleted <- store.DeleteCustomDomain(ctx, "owner", d.ID)
+			}()
+			close(start)
+			createErr, deleteErr := <-created, <-deleted
+			require.True(t, createErr == nil || deleteErr == nil, "one operation must succeed: create=%v, delete=%v", createErr, deleteErr)
+			if createErr == nil {
+				require.Error(t, deleteErr, "a committed service must block deletion")
+				stored, err := store.GetCustomDomain(ctx, "owner", d.ID)
+				require.NoError(t, err)
+				assert.True(t, stored.Validated, "the service must retain its authorization")
+				require.NoError(t, store.DeleteService(ctx, "owner", svc.ID))
+				require.NoError(t, store.DeleteCustomDomain(ctx, "owner", d.ID))
+				continue
+			}
+			require.NoError(t, deleteErr)
+			services, err := store.GetAccountServices(ctx, LockingStrengthNone, "owner")
+			require.NoError(t, err)
+			assert.Empty(t, services, "a deleted registration must not leave a new service")
+		}
+	})
+}

management/server/store/sql_store_domain_expiration.go

@@ -53,7 +53,10 @@ func customDomainServices(db *gorm.DB, d *domain.Domain) *gorm.DB {
 	// Shared domain validation permits underscores, and older rows may contain
 	// other LIKE metacharacters.
 	escaped := strings.NewReplacer("!", "!!", "%", "!%", "_", "!_").Replace(name)
-	return db.Model(&rpservice.Service{}).Where(
+	// Registrations are unique by name, so another account can hold a subdomain
+	// of this one and serve from it. Its services derive their cluster from that
+	// account's own registration and are not dependents of this one.
+	return db.Model(&rpservice.Service{}).Where(accountIDCondition, d.AccountID).Where(
 		"LOWER(domain) IN ? OR LOWER(domain) LIKE ? ESCAPE '!' OR LOWER(domain) LIKE ? ESCAPE '!'",
 		[]string{name, name + "."}, "%."+escaped, "%."+escaped+".",
 	)

management/server/store/sql_store_group.go

@@ -37,7 +37,7 @@ func (s *SqlStore) CreateGroups(ctx context.Context, accountID string, groups []
 		return nil
 	}
 
-	return s.db.Transaction(func(tx *gorm.DB) error {
+	return s.transaction(ctx, func(tx *gorm.DB) error {
 		result := tx.
 			Clauses(
 				clause.OnConflict{
@@ -63,7 +63,7 @@ func (s *SqlStore) UpdateGroups(ctx context.Context, accountID string, groups []
 		return nil
 	}
 
-	return s.db.Transaction(func(tx *gorm.DB) error {
+	return s.transaction(ctx, func(tx *gorm.DB) error {
 		result := tx.
 			Clauses(
 				clause.OnConflict{
@@ -137,7 +137,7 @@ func (s *SqlStore) GetResourceGroups(ctx context.Context, lockStrength LockingSt
 
 func (s *SqlStore) getGroups(ctx context.Context, accountID string) ([]*types.Group, error) {
 	const query = `SELECT id, account_id, public_id, name, issued, resources, integration_ref_id, integration_ref_integration_type FROM groups WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_group_peer.go

@@ -19,7 +19,7 @@ func (s *SqlStore) getGroupPeers(ctx context.Context, groupIDs []string) ([]type
 		return nil, nil
 	}
 	const query = `SELECT account_id, group_id, peer_id FROM group_peers WHERE group_id = ANY($1)`
-	rows, err := s.pool.Query(ctx, query, groupIDs)
+	rows, err := s.pgxPool().Query(ctx, query, groupIDs)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_idp_migration.go

@@ -57,11 +57,11 @@ func (s *SqlStore) ListUsers(ctx context.Context) ([]*types.User, error) {
 // txDeferFKConstraints defers foreign key constraint checks for the duration of the transaction.
 // MySQL is already handled by s.transaction (SET FOREIGN_KEY_CHECKS = 0).
 func (s *SqlStore) txDeferFKConstraints(tx *gorm.DB) error {
-	if s.storeEngine == types.SqliteStoreEngine {
+	if s.conn.Engine() == types.SqliteStoreEngine {
 		return tx.Exec("PRAGMA defer_foreign_keys = ON").Error
 	}
 
-	if s.storeEngine != types.PostgresStoreEngine {
+	if s.conn.Engine() != types.PostgresStoreEngine {
 		return nil
 	}
 
@@ -86,7 +86,7 @@ func (s *SqlStore) txDeferFKConstraints(tx *gorm.DB) error {
 // txRestoreFKConstraints reverts FK constraints back to NOT DEFERRABLE after the
 // deferred updates are done but before the transaction commits.
 func (s *SqlStore) txRestoreFKConstraints(tx *gorm.DB) error {
-	if s.storeEngine != types.PostgresStoreEngine {
+	if s.conn.Engine() != types.PostgresStoreEngine {
 		return nil
 	}
 
@@ -138,7 +138,7 @@ func (s *SqlStore) UpdateUserID(ctx context.Context, accountID, oldUserID, newUs
 	}
 
 	log.Info("Updating user ID in the store")
-	err := s.transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		if err := s.txDeferFKConstraints(tx); err != nil {
 			return err
 		}
@@ -161,7 +161,7 @@ func (s *SqlStore) UpdateUserID(ctx context.Context, accountID, oldUserID, newUs
 	}
 
 	log.Info("Restoring FK constraints")
-	err = s.transaction(func(tx *gorm.DB) error {
+	err = s.transaction(ctx, func(tx *gorm.DB) error {
 		if err := s.txRestoreFKConstraints(tx); err != nil {
 			return fmt.Errorf("restore FK constraints: %w", err)
 		}

management/server/store/sql_store_name_server_group.go

@@ -17,7 +17,7 @@ import (
 
 func (s *SqlStore) getNameServerGroups(ctx context.Context, accountID string) ([]nbdns.NameServerGroup, error) {
 	const query = `SELECT id, account_id, public_id, name, description, name_servers, groups, "primary", domains, enabled, search_domains_enabled FROM name_server_groups WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_network.go

@@ -15,7 +15,7 @@ import (
 
 func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networkTypes.Network, error) {
 	const query = `SELECT id, account_id, public_id, name, description FROM networks WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_network_resource.go

@@ -17,7 +17,7 @@ import (
 
 func (s *SqlStore) getNetworkResources(ctx context.Context, accountID string) ([]*resourceTypes.NetworkResource, error) {
 	const query = `SELECT id, network_id, account_id, public_id, name, description, type, domain, prefix, enabled FROM network_resources WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_network_router.go

@@ -19,7 +19,7 @@ import (
 
 func (s *SqlStore) getNetworkRouters(ctx context.Context, accountID string) ([]*routerTypes.NetworkRouter, error) {
 	const query = `SELECT id, network_id, account_id, public_id, peer, peer_groups, masquerade, metric, enabled FROM network_routers WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_peer.go

@@ -25,7 +25,7 @@ func (s *SqlStore) SavePeer(ctx context.Context, accountID string, peer *nbpeer.
 	peerCopy := peer.Copy()
 	peerCopy.AccountID = accountID
 
-	err := s.transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		// check if peer exists before saving
 		var peerID string
 		result := tx.Model(&nbpeer.Peer{}).Select("id").Take(&peerID, accountAndIDQueryCondition, accountID, peer.ID)
@@ -190,7 +190,7 @@ func (s *SqlStore) getPeers(ctx context.Context, accountID string) ([]nbpeer.Pee
 	peer_status_connected, peer_status_login_expired, peer_status_requires_approval, location_connection_ip,
 	location_country_code, location_city_name, location_geo_name_id, proxy_meta_embedded, proxy_meta_cluster, ipv6, meta_sync_message_version
 	FROM peers WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -492,7 +492,7 @@ func (s *SqlStore) GetPeerByPeerPubKey(ctx context.Context, lockStrength Locking
 }
 
 // GetAccountPeers retrieves peers for an account.
-func (s *SqlStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error) {
+func (s *SqlStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error) {
 	var peers []*nbpeer.Peer
 	tx := s.db
 	if lockStrength != LockingStrengthNone {
@@ -506,6 +506,11 @@ func (s *SqlStore) GetAccountPeers(ctx context.Context, lockStrength LockingStre
 	if ipFilter != "" {
 		query = query.Where("ip LIKE ? OR ipv6 LIKE ?", "%"+ipFilter+"%", "%"+ipFilter+"%")
 	}
+	// MAC addresses live in the JSON-serialized meta_network_addresses column,
+	// so we match the raw JSON text rather than a dedicated column.
+	if macFilter != "" {
+		query = query.Where("meta_network_addresses LIKE ?", "%"+macFilter+"%")
+	}
 
 	if err := query.Find(&peers).Error; err != nil {
 		log.WithContext(ctx).Errorf("failed to get peers from the store: %s", err)

management/server/store/sql_store_peer_test.go

@@ -512,7 +512,7 @@ func TestSqlStore_GetAccountPeers(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			peers, err := store.GetAccountPeers(context.Background(), LockingStrengthNone, tt.accountID, tt.nameFilter, tt.ipFilter)
+			peers, err := store.GetAccountPeers(context.Background(), LockingStrengthNone, tt.accountID, tt.nameFilter, tt.ipFilter, "")
 			require.NoError(t, err)
 			require.Len(t, peers, tt.expectedCount)
 		})
@@ -520,6 +520,48 @@ func TestSqlStore_GetAccountPeers(t *testing.T) {
 
 }
 
+func TestSqlStore_GetAccountPeers_FilterByMac(t *testing.T) {
+	ctx := context.Background()
+	store, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanup)
+
+	accountID := "test-account-mac"
+	userID := "test-user-mac"
+	account := newAccountWithId(ctx, accountID, userID, "example.com")
+	account.Peers["peer-mac-1"] = &nbpeer.Peer{
+		ID:        "peer-mac-1",
+		AccountID: accountID,
+		Key:       "peer-mac-key-1",
+		Name:      "macpeer",
+		IP:        netip.MustParseAddr("100.64.0.10"),
+		Meta: nbpeer.PeerSystemMeta{
+			NetworkAddresses: []nbpeer.NetworkAddress{
+				{NetIP: netip.MustParsePrefix("192.168.0.11/24"), Mac: "00:93:37:bd:83:0f"},
+			},
+		},
+	}
+	require.NoError(t, store.SaveAccount(ctx, account))
+
+	tests := []struct {
+		name          string
+		macFilter     string
+		expectedCount int
+	}{
+		{name: "full mac matches", macFilter: "00:93:37:bd:83:0f", expectedCount: 1},
+		{name: "mac prefix matches", macFilter: "00:93:37", expectedCount: 1},
+		{name: "unknown mac does not match", macFilter: "11:22:33:44:55:66", expectedCount: 0},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			peers, err := store.GetAccountPeers(ctx, LockingStrengthNone, accountID, "", "", tt.macFilter)
+			require.NoError(t, err)
+			require.Len(t, peers, tt.expectedCount)
+		})
+	}
+}
+
 func TestSqlStore_GetAccountPeersWithExpiration(t *testing.T) {
 	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store_with_expired_peers.sql", t.TempDir())
 	t.Cleanup(cleanup)
@@ -878,7 +920,7 @@ func TestSqlStore_ApproveAccountPeers(t *testing.T) {
 			require.NoError(t, err)
 			assert.Equal(t, 2, count)
 
-			allPeers, err := store.GetAccountPeers(ctx, LockingStrengthNone, accountID, "", "")
+			allPeers, err := store.GetAccountPeers(ctx, LockingStrengthNone, accountID, "", "", "")
 			require.NoError(t, err)
 
 			for _, peer := range allPeers {

management/server/store/sql_store_personal_access_token.go

@@ -45,7 +45,7 @@ func (s *SqlStore) getPersonalAccessTokens(ctx context.Context, userIDs []string
 		return nil, nil
 	}
 	const query = `SELECT id, user_id, name, hashed_token, expiration_date, created_by, created_at, last_used FROM personal_access_tokens WHERE user_id = ANY($1)`
-	rows, err := s.pool.Query(ctx, query, userIDs)
+	rows, err := s.pgxPool().Query(ctx, query, userIDs)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_policy.go

@@ -18,7 +18,7 @@ import (
 
 func (s *SqlStore) getPolicies(ctx context.Context, accountID string) ([]*types.Policy, error) {
 	const query = `SELECT id, account_id, public_id, name, description, enabled, source_posture_checks FROM policies WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -128,7 +128,7 @@ func (s *SqlStore) SavePolicy(ctx context.Context, policy *types.Policy) error {
 }
 
 func (s *SqlStore) DeletePolicy(ctx context.Context, accountID, policyID string) error {
-	return s.transaction(func(tx *gorm.DB) error {
+	return s.transaction(ctx, func(tx *gorm.DB) error {
 		if err := tx.Where("policy_id = ?", policyID).Delete(&types.PolicyRule{}).Error; err != nil {
 			return fmt.Errorf("delete policy rules: %w", err)
 		}

management/server/store/sql_store_policy_rule.go

@@ -18,7 +18,7 @@ func (s *SqlStore) getPolicyRules(ctx context.Context, policyIDs []string) ([]*t
 		return nil, nil
 	}
 	const query = `SELECT id, policy_id, name, description, enabled, action, destinations, destination_resource, sources, source_resource, bidirectional, protocol, ports, port_ranges, authorized_groups, authorized_user FROM policy_rules WHERE policy_id = ANY($1)`
-	rows, err := s.pool.Query(ctx, query, policyIDs)
+	rows, err := s.pgxPool().Query(ctx, query, policyIDs)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_posture_checks.go

@@ -16,7 +16,7 @@ import (
 
 func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*posture.Checks, error) {
 	const query = `SELECT id, account_id, public_id, name, description, checks FROM posture_checks WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_proxy.go

@@ -358,6 +358,14 @@ func (s *SqlStore) GetClusterSupportsPrivate(ctx context.Context, clusterAddr st
 	return s.getClusterCapability(ctx, clusterAddr, "private")
 }
 
+// GetClusterAllProxiesPrivate reports whether every active proxy in the cluster
+// has the private capability. Returns nil when no proxy reported the capability.
+// Use it where any proxy in the cluster may serve the result, since a single
+// non-private proxy would serve it without the private guarantees.
+func (s *SqlStore) GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "private")
+}
+
 // GetClusterSupportsCrowdSec returns whether all active proxies in the cluster
 // have CrowdSec configured. Returns nil when no proxy reported the capability.
 // Unlike other capabilities that use ANY-true (for rolling upgrades), CrowdSec
@@ -367,6 +375,21 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
+// GetActiveProxyVersions returns every active proxy version in a cluster.
+func (s *SqlStore) GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error) {
+	var versions []string
+	err := s.db.WithContext(ctx).
+		Model(&proxy.Proxy{}).
+		Where("LOWER(cluster_address) = LOWER(?) AND status = ? AND last_seen > ?",
+			clusterAddr, proxy.StatusConnected, time.Now().Add(-proxyActiveThreshold)).
+		Pluck("version", &versions).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to get active proxy versions for %s: %v", clusterAddr, err)
+		return nil, status.Errorf(status.Internal, "get active proxy versions")
+	}
+	return versions, nil
+}
+
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_route.go

@@ -17,7 +17,7 @@ import (
 
 func (s *SqlStore) getRoutes(ctx context.Context, accountID string) ([]route.Route, error) {
 	const query = `SELECT id, account_id, public_id, network, domains, keep_route, net_id, description, peer, peer_groups, network_type, masquerade, metric, enabled, groups, access_control_groups, skip_auto_apply FROM routes WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_service.go

@@ -30,7 +30,7 @@ const serviceSelectColumns = `id, account_id, name, domain, enabled, auth, restr
 func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
 	const serviceQuery = `SELECT ` + serviceSelectColumns + ` FROM services WHERE account_id = $1`
 
-	serviceRows, err := s.pool.Query(ctx, serviceQuery, accountID)
+	serviceRows, err := s.pgxPool().Query(ctx, serviceQuery, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -205,7 +205,7 @@ func (s *SqlStore) UpdateService(ctx context.Context, service *rpservice.Service
 	targetType := &rpservice.Target{}
 
 	// Use a transaction to ensure atomic updates of the service and its targets
-	err := s.db.Transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		// Delete existing targets
 		if err := tx.Where("service_id = ?", serviceCopy.ID).Delete(targetType).Error; err != nil {
 			return err

management/server/store/sql_store_service_target.go

@@ -26,7 +26,7 @@ const targetSelectColumns = `id, account_id, service_id, path, host, port, proto
 func (s *SqlStore) getServiceTargets(ctx context.Context, serviceIDs []string) ([]*rpservice.Target, error) {
 	const targetsQuery = `SELECT ` + targetSelectColumns + ` FROM targets WHERE service_id = ANY($1)`
 
-	rows, err := s.pool.Query(ctx, targetsQuery, serviceIDs)
+	rows, err := s.pgxPool().Query(ctx, targetsQuery, serviceIDs)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sql_store_setup_key.go

@@ -37,7 +37,7 @@ func (s *SqlStore) GetAccountBySetupKey(ctx context.Context, setupKey string) (*
 func (s *SqlStore) getSetupKeys(ctx context.Context, accountID string) ([]types.SetupKey, error) {
 	const query = `SELECT id, account_id, key, key_secret, name, type, created_at, expires_at, updated_at, 
 	revoked, used_times, last_used, auto_groups, usage_limit, ephemeral, allow_extra_dns_labels FROM setup_keys WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -127,7 +127,7 @@ func (s *SqlStore) GetSetupKeyBySecret(ctx context.Context, lockStrength Locking
 
 	if result.Error != nil {
 		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.PreconditionFailed, "setup key not found")
+			return nil, status.Errorf(status.PermissionDenied, "couldn't add peer: setup key is invalid")
 		}
 		log.WithContext(ctx).Errorf("failed to get setup key by secret from store: %v", result.Error)
 		return nil, status.Errorf(status.Internal, "failed to get setup key by secret from store")

management/server/store/sql_store_test.go

@@ -15,6 +15,8 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
@@ -346,7 +348,6 @@ func TestSqlStore_ExecuteInTransaction_Timeout(t *testing.T) {
 
 	sqlStore, ok := store.(*SqlStore)
 	require.True(t, ok)
-	assert.Equal(t, 1*time.Second, sqlStore.transactionTimeout)
 
 	ctx := context.Background()
 	err = sqlStore.ExecuteInTransaction(ctx, func(transaction Store) error {
@@ -411,3 +412,88 @@ func TestNewSqliteStore_BusyTimeoutRespectsUserOverride(t *testing.T) {
 		})
 	}
 }
+
+func TestSqlStore_ExecuteInTransaction_RestoresForeignKeyChecksOnMysql(t *testing.T) {
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		sqlStore := store.(*SqlStore)
+		if sqlStore.conn.Engine() != types.MysqlStoreEngine {
+			t.Skip("FOREIGN_KEY_CHECKS is MySQL specific")
+		}
+		sqlDB, err := sqlStore.GetDB().DB()
+		require.NoError(t, err)
+		sqlDB.SetMaxOpenConns(1)
+		ctx := context.Background()
+
+		foreignKeyChecks := func() int {
+			var enabled int
+			require.NoError(t, sqlStore.GetDB().Raw("SELECT @@SESSION.foreign_key_checks").Scan(&enabled).Error)
+			return enabled
+		}
+
+		err = store.ExecuteInTransaction(ctx, func(Store) error { return assert.AnError })
+		require.ErrorIs(t, err, assert.AnError)
+		assert.Equal(t, 1, foreignKeyChecks())
+
+		require.Panics(t, func() {
+			_ = store.ExecuteInTransaction(ctx, func(Store) error { panic("boom") })
+		})
+		assert.Equal(t, 1, foreignKeyChecks())
+
+		err = sqlStore.transaction(ctx, func(*gorm.DB) error { return assert.AnError })
+		require.ErrorIs(t, err, assert.AnError)
+		assert.Equal(t, 1, foreignKeyChecks())
+
+		err = store.ExecuteInTransaction(ctx, func(transaction Store) error {
+			bound := transaction.(*SqlStore)
+			require.NoError(t, bound.transaction(ctx, func(*gorm.DB) error { return nil }))
+			var enabled int
+			require.NoError(t, bound.GetDB().Raw("SELECT @@SESSION.foreign_key_checks").Scan(&enabled).Error)
+			assert.Equal(t, 0, enabled, "a savepoint must not re-enable FK checks for the rest of the transaction")
+			return nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, 1, foreignKeyChecks())
+	})
+}
+
+func TestSqlStore_Transaction_RollsBackOnError(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+		group := &types.Group{ID: "rolled-back-group", AccountID: accountID, Name: "rolled back", Issued: "api"}
+
+		err := store.(*SqlStore).transaction(ctx, func(tx *gorm.DB) error {
+			require.NoError(t, tx.Omit(clause.Associations).Create(group).Error)
+			return assert.AnError
+		})
+		require.ErrorIs(t, err, assert.AnError)
+
+		_, err = store.GetGroupByID(ctx, LockingStrengthNone, accountID, group.ID)
+		require.Error(t, err)
+	})
+}
+
+func TestSqlStore_Transaction_NestedIsSavepoint(t *testing.T) {
+	runTestForAllEngines(t, "../testdata/extended-store.sql", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+		outer := &types.Group{ID: "outer-group", AccountID: accountID, Name: "outer", Issued: "api"}
+		inner := &types.Group{ID: "inner-group", AccountID: accountID, Name: "inner", Issued: "api"}
+
+		err := store.ExecuteInTransaction(ctx, func(transaction Store) error {
+			require.NoError(t, transaction.CreateGroup(ctx, outer))
+			err := transaction.(*SqlStore).transaction(ctx, func(tx *gorm.DB) error {
+				require.NoError(t, tx.Omit(clause.Associations).Create(inner).Error)
+				return assert.AnError
+			})
+			require.ErrorIs(t, err, assert.AnError)
+			return nil
+		})
+		require.NoError(t, err)
+
+		_, err = store.GetGroupByID(ctx, LockingStrengthNone, accountID, outer.ID)
+		require.NoError(t, err)
+		_, err = store.GetGroupByID(ctx, LockingStrengthNone, accountID, inner.ID)
+		require.Error(t, err)
+	})
+}

management/server/store/sql_store_user.go

@@ -108,7 +108,7 @@ func (s *SqlStore) GetUserByUserID(ctx context.Context, lockStrength LockingStre
 }
 
 func (s *SqlStore) DeleteUser(ctx context.Context, accountID, userID string) error {
-	err := s.transaction(func(tx *gorm.DB) error {
+	err := s.transaction(ctx, func(tx *gorm.DB) error {
 		result := tx.Delete(&types.PersonalAccessToken{}, "user_id = ?", userID)
 		if result.Error != nil {
 			return result.Error
@@ -173,7 +173,7 @@ func (s *SqlStore) GetAccountOwner(ctx context.Context, lockStrength LockingStre
 
 func (s *SqlStore) getUsers(ctx context.Context, accountID string) ([]types.User, error) {
 	const query = `SELECT id, account_id, role, is_service_user, non_deletable, service_user_name, auto_groups, blocked, pending_approval, last_login, created_at, issued, integration_ref_id, integration_ref_integration_type, email, name FROM users WHERE account_id = $1`
-	rows, err := s.pool.Query(ctx, query, accountID)
+	rows, err := s.pgxPool().Query(ctx, query, accountID)
 	if err != nil {
 		return nil, err
 	}

management/server/store/sqlstore_bench_test.go

@@ -22,6 +22,7 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	nbdb "github.com/netbirdio/netbird/management/internals/shared/db"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -281,10 +282,11 @@ func setupBenchmarkDB(b testing.TB) (*SqlStore, func(), string) {
 		b.Fatalf("failed to migrate database: %v", err)
 	}
 
-	store := &SqlStore{
-		db:   db,
-		pool: pool,
+	conn, err := nbdb.NewConn(context.Background(), db, nbdb.PostgresStoreEngine, pool)
+	if err != nil {
+		b.Fatalf("failed to create connection: %v", err)
 	}
+	store := &SqlStore{conn: conn, db: conn.DB(nil)}
 
 	const (
 		accountID           = "benchmark-account-id"
@@ -527,7 +529,7 @@ func BenchmarkGetAccount(b *testing.B) {
 			}
 		}
 	})
-	store.pool.Close()
+	_ = store.Close(ctx)
 }
 
 func TestAccountEquivalence(t *testing.T) {

management/server/store/store.go

@@ -13,7 +13,6 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
-	"runtime"
 	"slices"
 	"strings"
 	"sync"
@@ -23,19 +22,19 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gorm.io/driver/mysql"
 	"gorm.io/driver/postgres"
-	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 
 	"github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
+	"github.com/netbirdio/netbird/management/internals/shared/db"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/management/server/testutil"
 	"github.com/netbirdio/netbird/management/server/types"
+	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/util/crypt"
 
@@ -49,14 +48,14 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
-type LockingStrength string
+type LockingStrength = db.LockingStrength
 
 const (
-	LockingStrengthUpdate      LockingStrength = "UPDATE"        // Strongest lock, preventing any changes by other transactions until your transaction completes.
-	LockingStrengthShare       LockingStrength = "SHARE"         // Allows reading but prevents changes by other transactions.
-	LockingStrengthNoKeyUpdate LockingStrength = "NO KEY UPDATE" // Similar to UPDATE but allows changes to related rows.
-	LockingStrengthKeyShare    LockingStrength = "KEY SHARE"     // Protects against changes to primary/unique keys but allows other updates.
-	LockingStrengthNone        LockingStrength = "NONE"          // No locking, allowing all transactions to proceed without restrictions.
+	LockingStrengthUpdate      = db.LockingStrengthUpdate
+	LockingStrengthShare       = db.LockingStrengthShare
+	LockingStrengthNoKeyUpdate = db.LockingStrengthNoKeyUpdate
+	LockingStrengthKeyShare    = db.LockingStrengthKeyShare
+	LockingStrengthNone        = db.LockingStrengthNone
 )
 
 type Store interface {
@@ -161,7 +160,7 @@ type Store interface {
 	RemoveResourceFromGroup(ctx context.Context, accountId string, groupID string, resourceID string) error
 	AddPeerToAccount(ctx context.Context, peer *nbpeer.Peer) error
 	GetPeerByPeerPubKey(ctx context.Context, lockStrength LockingStrength, peerKey string) (*nbpeer.Peer, error)
-	GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter string) ([]*nbpeer.Peer, error)
+	GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter, macFilter string) ([]*nbpeer.Peer, error)
 	GetUserPeers(ctx context.Context, lockStrength LockingStrength, accountID, userID string) ([]*nbpeer.Peer, error)
 	GetPeerByID(ctx context.Context, lockStrength LockingStrength, accountID string, peerID string) (*nbpeer.Peer, error)
 	GetPeersByIDs(ctx context.Context, lockStrength LockingStrength, accountID string, peerIDs []string) (map[string]*nbpeer.Peer, error)
@@ -307,6 +306,7 @@ type Store interface {
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
 	ListCustomDomains(ctx context.Context, accountID string) ([]*domain.Domain, error)
+	LockCustomDomains(ctx context.Context, accountID string, serviceDomain nbdomain.Domain) ([]*domain.Domain, error)
 	GetCustomDomainByName(ctx context.Context, domainName string) (*domain.Domain, error)
 	CreateCustomDomain(ctx context.Context, accountID string, domainName string, targetCluster string, validated bool) (*domain.Domain, error)
 	UpdateCustomDomain(ctx context.Context, accountID string, d *domain.Domain) (*domain.Domain, error)
@@ -314,15 +314,13 @@ type Store interface {
 	DeleteExpiredCustomDomain(ctx context.Context, d *domain.Domain, now time.Time) (bool, error)
 	DeleteCustomDomain(ctx context.Context, accountID string, domainID string) error
 
-	CreateAccessLog(ctx context.Context, log *accesslogs.AccessLogEntry) error
-	GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error)
-	DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error)
 	CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error
 	CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error
 	GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error)
 	GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error)
 	GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error)
 	DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error)
+	GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx context.Context) ([]string, error)
 	GetServiceTargetByTargetID(ctx context.Context, lockStrength LockingStrength, accountID string, targetID string) (*rpservice.Target, error)
 	GetTargetsByServiceID(ctx context.Context, lockStrength LockingStrength, accountID string, serviceID string) ([]*rpservice.Target, error)
 	DeleteTarget(ctx context.Context, accountID string, serviceID string, targetID uint) error
@@ -338,6 +336,8 @@ type Store interface {
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
+	GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool
+	GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error)
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)
 	DisconnectAllProxies(ctx context.Context) (int64, error)
@@ -390,6 +390,7 @@ type Store interface {
 	GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error)
 	GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error)
 	ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error)
+	DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx context.Context) (int64, error)
 	GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error)
 	GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error)
 	SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error
@@ -490,7 +491,7 @@ func getStoreEngine(ctx context.Context, dataDir string, kind types.Engine) type
 
 			// Migrate if it is the first run with a JSON file existing and no SQLite file present
 			jsonStoreFile := filepath.Join(dataDir, storeFileName)
-			sqliteStoreFile := filepath.Join(dataDir, storeSqliteFileName)
+			sqliteStoreFile := filepath.Join(dataDir, db.SqliteFileName)
 
 			if util.FileExists(jsonStoreFile) && !util.FileExists(sqliteStoreFile) {
 				log.WithContext(ctx).Warnf("unsupported store engine specified, but found %s. Automatically migrating to SQLite.", jsonStoreFile)
@@ -509,6 +510,16 @@ func getStoreEngine(ctx context.Context, dataDir string, kind types.Engine) type
 
 // NewStore creates a new store based on the provided engine type, data directory, and telemetry metrics
 func NewStore(ctx context.Context, kind types.Engine, dataDir string, metrics telemetry.AppMetrics, skipMigration bool) (Store, error) {
+	conn, err := OpenConn(ctx, kind, dataDir)
+	if err != nil {
+		return nil, err
+	}
+	return newStore(ctx, conn, metrics, skipMigration)
+}
+
+// OpenConn resolves the configured engine and opens the connection that the
+// store and the domain repositories share.
+func OpenConn(ctx context.Context, kind types.Engine, dataDir string) (*db.Conn, error) {
 	kind = getStoreEngine(ctx, dataDir, kind)
 
 	if err := checkFileStoreEngine(kind, dataDir); err != nil {
@@ -518,13 +529,21 @@ func NewStore(ctx context.Context, kind types.Engine, dataDir string, metrics te
 	switch kind {
 	case types.SqliteStoreEngine:
 		log.WithContext(ctx).Info("using SQLite store engine")
-		return NewSqliteStore(ctx, dataDir, metrics, skipMigration)
+		return db.OpenSqlite(ctx, dataDir)
 	case types.PostgresStoreEngine:
 		log.WithContext(ctx).Info("using Postgres store engine")
-		return newPostgresStore(ctx, metrics, skipMigration)
+		dsn, ok := lookupDSNEnv(PostgresDsnEnv, PostgresDsnEnvLegacy)
+		if !ok {
+			return nil, fmt.Errorf("%s is not set", PostgresDsnEnv)
+		}
+		return db.OpenPostgres(ctx, dsn, db.DefaultPoolConfig)
 	case types.MysqlStoreEngine:
 		log.WithContext(ctx).Info("using MySQL store engine")
-		return newMysqlStore(ctx, metrics, skipMigration)
+		dsn, ok := lookupDSNEnv(mysqlDsnEnv, mysqlDsnEnvLegacy)
+		if !ok {
+			return nil, fmt.Errorf("%s is not set", mysqlDsnEnv)
+		}
+		return db.OpenMysql(ctx, dsn)
 	default:
 		return nil, fmt.Errorf("unsupported kind of store: %s", kind)
 	}
@@ -698,32 +717,28 @@ func NewTestStoreFromSQL(ctx context.Context, filename string, dataDir string) (
 		kind = types.SqliteStoreEngine
 	}
 
-	storeStr := fmt.Sprintf("%s?cache=shared", storeSqliteFileName)
-	if runtime.GOOS == "windows" {
-		// Vo avoid `The process cannot access the file because it is being used by another process` on Windows
-		storeStr = storeSqliteFileName
-	}
-
-	file := filepath.Join(dataDir, storeStr)
-	db, err := gorm.Open(sqlite.Open(file), getGormConfig())
+	conn, err := db.OpenSqliteFile(ctx, dataDir, db.SqliteFileName)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, fmt.Errorf("failed to create test store: %v", err)
 	}
 
 	if filename != "" {
-		err = LoadSQL(db, filename)
+		err = LoadSQL(conn.DB(nil), filename)
 		if err != nil {
+			_ = conn.Close()
 			return nil, nil, fmt.Errorf("failed to load SQL file: %v", err)
 		}
 	}
 
-	store, err := NewSqlStore(ctx, db, types.SqliteStoreEngine, nil, false)
+	store, err := NewSqlStore(ctx, conn, nil, false)
 	if err != nil {
+		_ = conn.Close()
 		return nil, nil, fmt.Errorf("failed to create test store: %v", err)
 	}
 
 	err = addAllGroupToAccount(ctx, store)
 	if err != nil {
+		_ = store.Close(ctx)
 		return nil, nil, fmt.Errorf("failed to add all group to account: %v", err)
 	}
 
@@ -788,9 +803,6 @@ func getSqlStoreEngine(ctx context.Context, sqliteStore *SqlStore, kind types.En
 	closeConnection := func() {
 		cleanup()
 		store.Close(ctx)
-		if store.pool != nil {
-			store.pool.Close()
-		}
 		if store != sqliteStore {
 			// The sqlite store only seeded the engine under test; without this
 			// every test leaks its connection and the opener goroutines.
@@ -947,9 +959,6 @@ func postgresSchemaTemplate(ctx context.Context, baseDSN string, admin *gorm.DB)
 	// TEMPLATE refuses a source that still has sessions, so release both handles
 	// before the first clone.
 	tplStore.Close(ctx)
-	if tplStore.pool != nil {
-		tplStore.pool.Close()
-	}
 
 	schemaTemplates[key] = &schemaTemplate{dbName: name}
 	return name, nil
@@ -1034,11 +1043,11 @@ func mysqlTableNames(ctx context.Context, sqlDB *sql.DB, dbName string) ([]strin
 // cloneMysqlSchema replays the template's CREATE TABLE statements into the
 // database the DSN points at.
 func cloneMysqlSchema(ctx context.Context, dsn string, tableDDL []string) error {
-	db, err := gorm.Open(mysql.Open(dsn+"?charset=utf8&parseTime=True&loc=Local"), getGormConfig())
+	gormDB, err := gorm.Open(mysql.Open(db.MysqlDSN(dsn)), db.GormConfig())
 	if err != nil {
 		return fmt.Errorf("connect to test database: %w", err)
 	}
-	sqlDB, err := db.DB()
+	sqlDB, err := gormDB.DB()
 	if err != nil {
 		return err
 	}
@@ -1078,19 +1087,19 @@ func closeGormDB(db *gorm.DB) {
 }
 
 func openDBWithRetry(dsn string, engine types.Engine, maxRetries int) (*gorm.DB, error) {
-	var db *gorm.DB
+	var gormDB *gorm.DB
 	var err error
 
 	for i := range maxRetries {
 		switch engine {
 		case types.PostgresStoreEngine:
-			db, err = gorm.Open(postgres.Open(dsn), &gorm.Config{})
+			gormDB, err = gorm.Open(postgres.Open(dsn), &gorm.Config{})
 		case types.MysqlStoreEngine:
-			db, err = gorm.Open(mysql.Open(dsn+"?charset=utf8&parseTime=True&loc=Local"), &gorm.Config{})
+			gormDB, err = gorm.Open(mysql.Open(db.MysqlDSN(dsn)), &gorm.Config{})
 		}
 
 		if err == nil {
-			return db, nil
+			return gormDB, nil
 		}
 
 		if i < maxRetries-1 {
@@ -1104,14 +1113,14 @@ func openDBWithRetry(dsn string, engine types.Engine, maxRetries int) (*gorm.DB,
 
 // createRandomDB creates a uniquely named database for one test. On postgres a
 // non-empty template is copied server-side with CREATE DATABASE ... TEMPLATE.
-func createRandomDB(dsn string, db *gorm.DB, engine types.Engine, template string) (string, func(), error) {
+func createRandomDB(dsn string, admin *gorm.DB, engine types.Engine, template string) (string, func(), error) {
 	dbName := newTestDBName("test_db")
 
 	createStmt := fmt.Sprintf("CREATE DATABASE %s", dbName)
 	if template != "" && engine == types.PostgresStoreEngine {
 		createStmt = fmt.Sprintf("CREATE DATABASE %s TEMPLATE %s", dbName, template)
 	}
-	if err := execWithTemplateRetry(db, createStmt); err != nil {
+	if err := execWithTemplateRetry(admin, createStmt); err != nil {
 		return "", nil, fmt.Errorf("failed to create database: %v", err)
 	}
 
@@ -1146,7 +1155,7 @@ func createRandomDB(dsn string, db *gorm.DB, engine types.Engine, template strin
 			err = dropDB.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s WITH (FORCE)", dbName)).Error
 
 		case types.MysqlStoreEngine:
-			dropDB, err = gorm.Open(mysql.Open(originalDSN+"?charset=utf8&parseTime=True&loc=Local"), &gorm.Config{
+			dropDB, err = gorm.Open(mysql.Open(db.MysqlDSN(originalDSN)), &gorm.Config{
 				SkipDefaultTransaction: true,
 				PrepareStmt:            false,
 			})
@@ -1224,7 +1233,7 @@ func MigrateFileStoreToSqlite(ctx context.Context, dataDir string) error {
 		return fmt.Errorf("%s doesn't exist, couldn't continue the operation", fileStorePath)
 	}
 
-	sqlStorePath := path.Join(dataDir, storeSqliteFileName)
+	sqlStorePath := path.Join(dataDir, db.SqliteFileName)
 	if _, err := os.Stat(sqlStorePath); err == nil {
 		return fmt.Errorf("%s already exists, couldn't continue the operation", sqlStorePath)
 	}

management/server/store/store_mock.go

@@ -18,7 +18,6 @@ import (
 
 	dns "github.com/netbirdio/netbird/dns"
 	types "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	accesslogs "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	domain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	proxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	service "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -31,6 +30,7 @@ import (
 	posture "github.com/netbirdio/netbird/management/server/posture"
 	types3 "github.com/netbirdio/netbird/management/server/types"
 	route "github.com/netbirdio/netbird/route"
+	domain0 "github.com/netbirdio/netbird/shared/management/domain"
 	crypt "github.com/netbirdio/netbird/util/crypt"
 	gomock "go.uber.org/mock/gomock"
 )
@@ -246,20 +246,6 @@ func (mr *MockStoreMockRecorder) CountProxiesByAccountID(ctx, accountID any) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountProxiesByAccountID", reflect.TypeOf((*MockStore)(nil).CountProxiesByAccountID), ctx, accountID)
 }
 
-// CreateAccessLog mocks base method.
-func (m *MockStore) CreateAccessLog(ctx context.Context, log *accesslogs.AccessLogEntry) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAccessLog", ctx, log)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateAccessLog indicates an expected call of CreateAccessLog.
-func (mr *MockStoreMockRecorder) CreateAccessLog(ctx, log any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAccessLog), ctx, log)
-}
-
 // CreateAgentNetworkAccessLog mocks base method.
 func (m *MockStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) error {
 	m.ctrl.T.Helper()
@@ -471,6 +457,21 @@ func (mr *MockStoreMockRecorder) DeleteAgentNetworkBudgetRule(ctx, accountID, ru
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkBudgetRule), ctx, accountID, ruleID)
 }
 
+// DeleteAgentNetworkConsumptionOfDeletedAccounts mocks base method.
+func (m *MockStore) DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx context.Context) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkConsumptionOfDeletedAccounts", ctx)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteAgentNetworkConsumptionOfDeletedAccounts indicates an expected call of DeleteAgentNetworkConsumptionOfDeletedAccounts.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkConsumptionOfDeletedAccounts(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkConsumptionOfDeletedAccounts", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkConsumptionOfDeletedAccounts), ctx)
+}
+
 // DeleteAgentNetworkGuardrail mocks base method.
 func (m *MockStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
 	m.ctrl.T.Helper()
@@ -668,21 +669,6 @@ func (mr *MockStoreMockRecorder) DeleteNetworkRouter(ctx, accountID, routerID an
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteNetworkRouter", reflect.TypeOf((*MockStore)(nil).DeleteNetworkRouter), ctx, accountID, routerID)
 }
 
-// DeleteOldAccessLogs mocks base method.
-func (m *MockStore) DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteOldAccessLogs", ctx, olderThan)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// DeleteOldAccessLogs indicates an expected call of DeleteOldAccessLogs.
-func (mr *MockStoreMockRecorder) DeleteOldAccessLogs(ctx, olderThan any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAccessLogs), ctx, olderThan)
-}
-
 // DeleteOldAgentNetworkAccessLogs mocks base method.
 func (m *MockStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
 	m.ctrl.T.Helper()
@@ -967,22 +953,6 @@ func (mr *MockStoreMockRecorder) GetAccount(ctx, accountID any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccount", reflect.TypeOf((*MockStore)(nil).GetAccount), ctx, accountID)
 }
 
-// GetAccountAccessLogs mocks base method.
-func (m *MockStore) GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAccessLogs", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*accesslogs.AccessLogEntry)
-	ret1, _ := ret[1].(int64)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetAccountAccessLogs indicates an expected call of GetAccountAccessLogs.
-func (mr *MockStoreMockRecorder) GetAccountAccessLogs(ctx, lockStrength, accountID, filter any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAccountAccessLogs), ctx, lockStrength, accountID, filter)
-}
-
 // GetAccountAgentNetworkBudgetRules mocks base method.
 func (m *MockStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*types.AccountBudgetRule, error) {
 	m.ctrl.T.Helper()
@@ -1360,18 +1330,18 @@ func (mr *MockStoreMockRecorder) GetAccountOwner(ctx, lockStrength, accountID an
 }
 
 // GetAccountPeers mocks base method.
-func (m *MockStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter string) ([]*peer.Peer, error) {
+func (m *MockStore) GetAccountPeers(ctx context.Context, lockStrength LockingStrength, accountID, nameFilter, ipFilter, macFilter string) ([]*peer.Peer, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountPeers", ctx, lockStrength, accountID, nameFilter, ipFilter)
+	ret := m.ctrl.Call(m, "GetAccountPeers", ctx, lockStrength, accountID, nameFilter, ipFilter, macFilter)
 	ret0, _ := ret[0].([]*peer.Peer)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // GetAccountPeers indicates an expected call of GetAccountPeers.
-func (mr *MockStoreMockRecorder) GetAccountPeers(ctx, lockStrength, accountID, nameFilter, ipFilter any) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetAccountPeers(ctx, lockStrength, accountID, nameFilter, ipFilter, macFilter any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockStore)(nil).GetAccountPeers), ctx, lockStrength, accountID, nameFilter, ipFilter)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountPeers", reflect.TypeOf((*MockStore)(nil).GetAccountPeers), ctx, lockStrength, accountID, nameFilter, ipFilter, macFilter)
 }
 
 // GetAccountPeersWithExpiration mocks base method.
@@ -1584,6 +1554,21 @@ func (mr *MockStoreMockRecorder) GetActiveProxyClusterAddressesForAccount(ctx, a
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveProxyClusterAddressesForAccount", reflect.TypeOf((*MockStore)(nil).GetActiveProxyClusterAddressesForAccount), ctx, accountID)
 }
 
+// GetActiveProxyVersions mocks base method.
+func (m *MockStore) GetActiveProxyVersions(ctx context.Context, clusterAddr string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetActiveProxyVersions", ctx, clusterAddr)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetActiveProxyVersions indicates an expected call of GetActiveProxyVersions.
+func (mr *MockStoreMockRecorder) GetActiveProxyVersions(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveProxyVersions", reflect.TypeOf((*MockStore)(nil).GetActiveProxyVersions), ctx, clusterAddr)
+}
+
 // GetAgentNetworkAccessLogSessions mocks base method.
 func (m *MockStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
 	m.ctrl.T.Helper()
@@ -1885,6 +1870,20 @@ func (mr *MockStoreMockRecorder) GetAnyAccountID(ctx any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAnyAccountID", reflect.TypeOf((*MockStore)(nil).GetAnyAccountID), ctx)
 }
 
+// GetClusterAllProxiesPrivate mocks base method.
+func (m *MockStore) GetClusterAllProxiesPrivate(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterAllProxiesPrivate", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// GetClusterAllProxiesPrivate indicates an expected call of GetClusterAllProxiesPrivate.
+func (mr *MockStoreMockRecorder) GetClusterAllProxiesPrivate(ctx, clusterAddr any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterAllProxiesPrivate", reflect.TypeOf((*MockStore)(nil).GetClusterAllProxiesPrivate), ctx, clusterAddr)
+}
+
 // GetClusterRequireSubdomain mocks base method.
 func (m *MockStore) GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -2002,6 +2001,21 @@ func (mr *MockStoreMockRecorder) GetDNSRecordByID(ctx, lockStrength, accountID,
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDNSRecordByID", reflect.TypeOf((*MockStore)(nil).GetDNSRecordByID), ctx, lockStrength, accountID, zoneID, recordID)
 }
 
+// GetDeletedAccountIDsWithAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx context.Context) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetDeletedAccountIDsWithAgentNetworkAccessLogs", ctx)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetDeletedAccountIDsWithAgentNetworkAccessLogs indicates an expected call of GetDeletedAccountIDsWithAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) GetDeletedAccountIDsWithAgentNetworkAccessLogs(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDeletedAccountIDsWithAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetDeletedAccountIDsWithAgentNetworkAccessLogs), ctx)
+}
+
 // GetEmbeddedProxyPeerIDsByCluster mocks base method.
 func (m *MockStore) GetEmbeddedProxyPeerIDsByCluster(ctx context.Context, accountID string) (map[string][]string, error) {
 	m.ctrl.T.Helper()
@@ -2176,7 +2190,7 @@ func (m *MockStore) GetNetworkResourceByIDOrPublicID(ctx context.Context, lockSt
 }
 
 // GetNetworkResourceByIDOrPublicID indicates an expected call of GetNetworkResourceByIDOrPublicID.
-func (mr *MockStoreMockRecorder) GetNetworkResourceByIDOrPublicID(ctx, lockStrength, accountID, resourceID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetNetworkResourceByIDOrPublicID(ctx, lockStrength, accountID, resourceID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetNetworkResourceByIDOrPublicID", reflect.TypeOf((*MockStore)(nil).GetNetworkResourceByIDOrPublicID), ctx, lockStrength, accountID, resourceID)
 }
@@ -2521,7 +2535,7 @@ func (m *MockStore) GetPolicyByIDOrPublicID(ctx context.Context, lockStrength Lo
 }
 
 // GetPolicyByIDOrPublicID indicates an expected call of GetPolicyByIDOrPublicID.
-func (mr *MockStoreMockRecorder) GetPolicyByIDOrPublicID(ctx, lockStrength, accountID, policyID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetPolicyByIDOrPublicID(ctx, lockStrength, accountID, policyID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPolicyByIDOrPublicID", reflect.TypeOf((*MockStore)(nil).GetPolicyByIDOrPublicID), ctx, lockStrength, accountID, policyID)
 }
@@ -2716,7 +2730,7 @@ func (m *MockStore) GetRouteByIDOrPublicID(ctx context.Context, lockStrength Loc
 }
 
 // GetRouteByIDOrPublicID indicates an expected call of GetRouteByIDOrPublicID.
-func (mr *MockStoreMockRecorder) GetRouteByIDOrPublicID(ctx, lockStrength, accountID, routeID interface{}) *gomock.Call {
+func (mr *MockStoreMockRecorder) GetRouteByIDOrPublicID(ctx, lockStrength, accountID, routeID any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRouteByIDOrPublicID", reflect.TypeOf((*MockStore)(nil).GetRouteByIDOrPublicID), ctx, lockStrength, accountID, routeID)
 }
@@ -3302,6 +3316,21 @@ func (mr *MockStoreMockRecorder) ListFreeDomains(ctx, accountID any) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListFreeDomains", reflect.TypeOf((*MockStore)(nil).ListFreeDomains), ctx, accountID)
 }
 
+// LockCustomDomains mocks base method.
+func (m *MockStore) LockCustomDomains(ctx context.Context, accountID string, serviceDomain domain0.Domain) ([]*domain.Domain, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "LockCustomDomains", ctx, accountID, serviceDomain)
+	ret0, _ := ret[0].([]*domain.Domain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// LockCustomDomains indicates an expected call of LockCustomDomains.
+func (mr *MockStoreMockRecorder) LockCustomDomains(ctx, accountID, serviceDomain any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LockCustomDomains", reflect.TypeOf((*MockStore)(nil).LockCustomDomains), ctx, accountID, serviceDomain)
+}
+
 // MarkAccountPrimary mocks base method.
 func (m *MockStore) MarkAccountPrimary(ctx context.Context, accountID string) error {
 	m.ctrl.T.Helper()

management/server/types/account_networkmapdata.go

@@ -213,8 +213,7 @@ func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	}
 }
 
-// TwinPeer converts a real peer to its slim nmdata twin. Exported for the
-// port-forwarding integration, which builds proxy NetworkMaps holding twins.
+// TwinPeer converts a real peer to its slim nmdata twin.
 func TwinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	return twinPeer(p)
 }

management/server/types/aliases.go

@@ -15,7 +15,6 @@ import (
 type FirewallRule = sharedtypes.FirewallRule
 
 type NetworkMap = sharedtypes.NetworkMap
-type ForwardingRule = sharedtypes.ForwardingRule
 
 type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType
 type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType

management/server/types/legacynmap/aliases.go

@@ -10,7 +10,6 @@ type (
 
 	DNSSettings       = types.DNSSettings
 	FirewallRule      = sharedtypes.FirewallRule
-	ForwardingRule    = sharedtypes.ForwardingRule
 	Group             = types.Group
 	Network           = types.Network
 	Policy            = types.Policy

management/server/types/legacynmap/converters.go

@@ -19,7 +19,6 @@ type NetworkMap struct {
 	OfflinePeers        []*ComponentPeer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
 	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS

management/server/types/legacynmap/equivalence_test.go

@@ -320,7 +320,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -550,16 +549,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""
@@ -591,7 +580,6 @@ func describeDivergence(legacy, updated *proto.NetworkMap, accountID, peerID str
 		{"Routes", len(legacy.Routes), len(updated.Routes), func() string { return diffLists(legacy.Routes, updated.Routes) }},
 		{"FirewallRules", len(legacy.FirewallRules), len(updated.FirewallRules), func() string { return diffLists(legacy.FirewallRules, updated.FirewallRules) }},
 		{"RoutesFirewallRules", len(legacy.RoutesFirewallRules), len(updated.RoutesFirewallRules), func() string { return diffLists(legacy.RoutesFirewallRules, updated.RoutesFirewallRules) }},
-		{"ForwardingRules", len(legacy.ForwardingRules), len(updated.ForwardingRules), func() string { return diffLists(legacy.ForwardingRules, updated.ForwardingRules) }},
 	}
 	for _, l := range lens {
 		if l.a != l.b {

management/server/types/legacynmap/proto_legacy.go

@@ -186,14 +186,6 @@ func ToProtoNetworkMap(
 	pm.RoutesFirewallRules = routesFirewallRules
 	pm.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if nm.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, rule := range nm.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		pm.ForwardingRules = forwardingRules
-	}
-
 	if nm.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, nm.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim

management/server/types/networkmap_wire_benchmark_test.go

@@ -66,7 +66,7 @@ func BenchmarkNetworkMapWireEncode(b *testing.B) {
 
 		// Pre-encode once so the size metric is identical for every run inside
 		// the same scale; the b.Loop call only re-runs encode + Marshal.
-		legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+		legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0, "")
 		legacyBytes, err := goproto.Marshal(legacyResp.NetworkMap)
 		if err != nil {
 			b.Fatalf("marshal legacy networkmap: %v", err)
@@ -88,7 +88,7 @@ func BenchmarkNetworkMapWireEncode(b *testing.B) {
 			b.ReportMetric(float64(len(legacyBytes)), "bytes/msg")
 			b.ResetTimer()
 			for range b.N {
-				resp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+				resp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0, "")
 				if _, err := goproto.Marshal(resp.NetworkMap); err != nil {
 					b.Fatal(err)
 				}
@@ -135,7 +135,7 @@ func BenchmarkNetworkMapWireSize(b *testing.B) {
 		dnsCache := &cache.DNSConfigCache{}
 		settings := &types.Settings{}
 
-		legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0)
+		legacyResp := mgmtgrpc.ToSyncResponse(ctx, nil, nil, nil, types.TwinPeer(peer), nil, nil, networkMap, "netbird.cloud", nil, dnsCache, types.TwinAccountSettings(settings), nil, nil, 0, "")
 		legacyBytes, err := goproto.Marshal(legacyResp.NetworkMap)
 		if err != nil {
 			b.Fatalf("marshal legacy networkmap: %v", err)