[agent-network] Co-locate HTTP handlers in the module (RegisterEndpoints)

Move the agent-network HTTP handlers from server/http/handlers/agentnetwork into
the module at internals/modules/agentnetwork/handlers (package handlers) and
rename the entrypoint AddEndpoints -> RegisterEndpoints, matching the
reverse-proxy module convention. Wiring in http/handler.go updated accordingly.

management/server/http/handler.go

@@ -23,13 +23,13 @@ import (
 	idpmanager "github.com/netbirdio/netbird/management/server/idp"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agentnetworkhandlers "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/handlers"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	zonesManager "github.com/netbirdio/netbird/management/internals/modules/zones/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	agentnetworkhandlers "github.com/netbirdio/netbird/management/server/http/handlers/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/settings"
 
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -127,7 +127,7 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 	recordsManager.RegisterEndpoints(router, rManager)
 	idp.AddEndpoints(accountManager, router)
 	if agentNetworkManager != nil {
-		agentnetworkhandlers.AddEndpoints(agentNetworkManager, router)
+		agentnetworkhandlers.RegisterEndpoints(agentNetworkManager, router)
 	}
 	instance.AddEndpoints(instanceManager, accountManager, router)
 	instance.AddVersionEndpoint(instanceManager, router)

management/server/http/handlers/agentnetwork/access_log_handler.go

@@ -1,91 +0,0 @@
-package agentnetwork
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-// addAccessLogEndpoints registers the read-only, server-side-filtered
-// agent-network access-log listing and the aggregated usage overview.
-func (h *handler) addAccessLogEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/access-logs", h.listAccessLogs).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/usage/overview", h.getUsageOverview).Methods("GET", "OPTIONS")
-}
-
-func (h *handler) getUsageOverview(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	// Reuse the access-log filter for the shared date/user/group/provider/model
-	// params; pagination/sort/search are irrelevant for an aggregate.
-	var filter types.AgentNetworkAccessLogFilter
-	if err := filter.ParseFromRequest(r); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	// Bound the aggregation window so an unbounded or over-wide query can't load
-	// an account's entire usage history into memory.
-	filter.ApplyUsageOverviewBounds(time.Now())
-	granularity := types.ParseUsageGranularity(r.URL.Query().Get("granularity"))
-
-	buckets, err := h.manager.GetUsageOverview(r.Context(), userAuth.AccountId, userAuth.UserId, filter, granularity)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]api.AgentNetworkUsageBucket, 0, len(buckets))
-	for _, b := range buckets {
-		out = append(out, b.ToAPIResponse())
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func (h *handler) listAccessLogs(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var filter types.AgentNetworkAccessLogFilter
-	if err := filter.ParseFromRequest(r); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rows, total, err := h.manager.ListAccessLogs(r.Context(), userAuth.AccountId, userAuth.UserId, filter)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	data := make([]api.AgentNetworkAccessLog, 0, len(rows))
-	for _, row := range rows {
-		data = append(data, row.ToAPIResponse())
-	}
-
-	pageSize := filter.GetLimit()
-	totalPages := 0
-	if pageSize > 0 {
-		totalPages = int((total + int64(pageSize) - 1) / int64(pageSize))
-	}
-
-	util.WriteJSONObject(r.Context(), w, api.AgentNetworkAccessLogsResponse{
-		Data:         data,
-		Page:         filter.Page,
-		PageSize:     pageSize,
-		TotalRecords: int(total),
-		TotalPages:   totalPages,
-	})
-}

management/server/http/handlers/agentnetwork/budget_handler.go

@@ -1,172 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// addBudgetRuleEndpoints registers the account-level budget rule routes.
-func (h *handler) addBudgetRuleEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/budget-rules", h.getAllBudgetRules).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/budget-rules", h.createBudgetRule).Methods("POST", "OPTIONS")
-	router.HandleFunc("/agent-network/budget-rules/{ruleId}", h.getBudgetRule).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/budget-rules/{ruleId}", h.updateBudgetRule).Methods("PUT", "OPTIONS")
-	router.HandleFunc("/agent-network/budget-rules/{ruleId}", h.deleteBudgetRule).Methods("DELETE", "OPTIONS")
-}
-
-func (h *handler) getAllBudgetRules(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rules, err := h.manager.GetAllBudgetRules(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]*api.AgentNetworkBudgetRule, 0, len(rules))
-	for _, rule := range rules {
-		out = append(out, rule.ToAPIResponse())
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func (h *handler) getBudgetRule(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	ruleID := mux.Vars(r)["ruleId"]
-	if ruleID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "budget rule ID is required"), w)
-		return
-	}
-
-	rule, err := h.manager.GetBudgetRule(r.Context(), userAuth.AccountId, userAuth.UserId, ruleID)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, rule.ToAPIResponse())
-}
-
-func (h *handler) createBudgetRule(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkBudgetRuleRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validateBudgetRule(&req); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rule := types.NewAccountBudgetRule(userAuth.AccountId)
-	rule.FromAPIRequest(&req)
-
-	created, err := h.manager.CreateBudgetRule(r.Context(), userAuth.UserId, rule)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
-}
-
-func (h *handler) updateBudgetRule(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	ruleID := mux.Vars(r)["ruleId"]
-	if ruleID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "budget rule ID is required"), w)
-		return
-	}
-
-	var req api.AgentNetworkBudgetRuleRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validateBudgetRule(&req); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rule := &types.AccountBudgetRule{ID: ruleID, AccountID: userAuth.AccountId}
-	rule.FromAPIRequest(&req)
-
-	updated, err := h.manager.UpdateBudgetRule(r.Context(), userAuth.UserId, rule)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
-}
-
-func (h *handler) deleteBudgetRule(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	ruleID := mux.Vars(r)["ruleId"]
-	if ruleID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "budget rule ID is required"), w)
-		return
-	}
-
-	if err := h.manager.DeleteBudgetRule(r.Context(), userAuth.AccountId, userAuth.UserId, ruleID); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
-}
-
-// validateBudgetRule rejects malformed budget rules. It reuses the policy limit
-// validation since the cap shape is identical, and rejects empty target entries.
-func validateBudgetRule(req *api.AgentNetworkBudgetRuleRequest) error {
-	if strings.TrimSpace(req.Name) == "" {
-		return status.Errorf(status.InvalidArgument, "name is required")
-	}
-	if req.TargetGroups != nil {
-		for _, id := range *req.TargetGroups {
-			if strings.TrimSpace(id) == "" {
-				return status.Errorf(status.InvalidArgument, "target_groups must not contain empty entries")
-			}
-		}
-	}
-	if req.TargetUsers != nil {
-		for _, id := range *req.TargetUsers {
-			if strings.TrimSpace(id) == "" {
-				return status.Errorf(status.InvalidArgument, "target_users must not contain empty entries")
-			}
-		}
-	}
-	return validatePolicyLimits(req.Limits)
-}

management/server/http/handlers/agentnetwork/budget_handler_test.go

@@ -1,131 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// TestBudgetRuleHandler_RoundTrip seeds a budget rule via the store and asserts
-// the GET wire shape carries targets and the reused PolicyLimits cap shape. The
-// create/update/delete success paths go through accountManager.StoreEvent which
-// this fixture doesn't wire — they are covered by the manager-level no-mock
-// test (TestAgentNetwork_BudgetRuleCRUD_RealManager).
-func TestBudgetRuleHandler_RoundTrip(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rule := &agentNetworkTypes.AccountBudgetRule{
-		ID:           "ainbud_test",
-		AccountID:    testAccountID,
-		Name:         "org-monthly",
-		Enabled:      true,
-		TargetGroups: []string{"grp-eng"},
-		TargetUsers:  []string{"user-alice"},
-		Limits: agentNetworkTypes.PolicyLimits{
-			TokenLimit:  agentNetworkTypes.PolicyTokenLimit{Enabled: true, GroupCap: 100000, UserCap: 10000, WindowSeconds: 2_592_000},
-			BudgetLimit: agentNetworkTypes.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 500, WindowSeconds: 2_592_000},
-		},
-	}
-	require.NoError(t, f.store.SaveAgentNetworkBudgetRule(context.Background(), rule))
-
-	rec := f.do(t, http.MethodGet, "/agent-network/budget-rules/"+rule.ID, "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkBudgetRule
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "org-monthly", got.Name, "name must round-trip")
-	assert.Equal(t, []string{"grp-eng"}, got.TargetGroups, "target groups must round-trip")
-	assert.Equal(t, []string{"user-alice"}, got.TargetUsers, "target users must round-trip")
-	assert.Equal(t, int64(100000), got.Limits.TokenLimit.GroupCap, "token group cap must round-trip")
-	assert.Equal(t, int64(2_592_000), got.Limits.BudgetLimit.WindowSeconds, "budget window must round-trip")
-}
-
-// TestBudgetRuleHandler_ListReturnsArray asserts the list endpoint returns a
-// JSON array (never null) for an account with no rules.
-func TestBudgetRuleHandler_ListReturnsArray(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodGet, "/agent-network/budget-rules", "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
-	assert.Equal(t, "[]", trimSpace(rec.Body.String()), "empty account must return an empty array, not null")
-}
-
-// TestBudgetRuleHandler_RejectsMissingName covers the validation path (which
-// runs before the manager call, so it works without a wired accountManager).
-func TestBudgetRuleHandler_RejectsMissingName(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	body := `{
-        "name": "",
-        "limits": {
-            "token_limit": {"enabled": false, "group_cap": 0, "user_cap": 0, "window_seconds": 0},
-            "budget_limit": {"enabled": false, "group_cap_usd": 0, "user_cap_usd": 0, "window_seconds": 0}
-        }
-    }`
-	rec := f.do(t, http.MethodPost, "/agent-network/budget-rules", body)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"missing name must be rejected as a validation error (not a route/auth 4xx): got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "name",
-		"rejection body must name the offending field, proving the validation path: %s", rec.Body.String())
-}
-
-// TestBudgetRuleHandler_RejectsSubMinuteWindow proves budget rules reuse the
-// policy-limit validation (enabled limit needs window >= 60s).
-func TestBudgetRuleHandler_RejectsSubMinuteWindow(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	body := `{
-        "name": "bad-window",
-        "limits": {
-            "token_limit": {"enabled": true, "group_cap": 1000, "user_cap": 0, "window_seconds": 30},
-            "budget_limit": {"enabled": false, "group_cap_usd": 0, "user_cap_usd": 0, "window_seconds": 0}
-        }
-    }`
-	rec := f.do(t, http.MethodPost, "/agent-network/budget-rules", body)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"sub-minute window must be rejected as a validation error (not a route/auth 4xx): got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "window_seconds",
-		"rejection body must name the offending window_seconds field, proving the validation path: %s", rec.Body.String())
-}
-
-// TestSettingsHandler_GetExposesCollectionToggles asserts the GET settings wire
-// shape carries the account-level collection toggles after a store seed.
-func TestSettingsHandler_GetExposesCollectionToggles(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	require.NoError(t, f.store.SaveAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
-		AccountID:              testAccountID,
-		Cluster:                "eu.proxy.netbird.io",
-		Subdomain:              "violet",
-		EnableLogCollection:    true,
-		EnablePromptCollection: true,
-		RedactPii:              false,
-	}))
-
-	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.True(t, got.EnableLogCollection, "log collection toggle must surface on the wire")
-	assert.True(t, got.EnablePromptCollection, "prompt collection toggle must surface on the wire")
-	assert.False(t, got.RedactPii, "redact toggle must surface its false value")
-	assert.Equal(t, "violet.eu.proxy.netbird.io", got.Endpoint, "endpoint stays computed from immutable cluster+subdomain")
-}
-
-func trimSpace(s string) string {
-	for len(s) > 0 && (s[len(s)-1] == '\n' || s[len(s)-1] == ' ' || s[len(s)-1] == '\t' || s[len(s)-1] == '\r') {
-		s = s[:len(s)-1]
-	}
-	for len(s) > 0 && (s[0] == '\n' || s[0] == ' ' || s[0] == '\t' || s[0] == '\r') {
-		s = s[1:]
-	}
-	return s
-}

management/server/http/handlers/agentnetwork/consumption_handler.go

@@ -1,53 +0,0 @@
-package agentnetwork
-
-import (
-	"net/http"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-// addConsumptionEndpoints registers the read-only Agent Network
-// consumption listing — backs the dashboard's basic counter view.
-func (h *handler) addConsumptionEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/consumption", h.listConsumption).Methods("GET", "OPTIONS")
-}
-
-func (h *handler) listConsumption(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rows, err := h.manager.ListConsumption(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]api.AgentNetworkConsumption, 0, len(rows))
-	for _, row := range rows {
-		out = append(out, consumptionToAPI(row))
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func consumptionToAPI(c *types.Consumption) api.AgentNetworkConsumption {
-	windowStart := c.WindowStartUTC
-	updatedAt := c.UpdatedAt
-	return api.AgentNetworkConsumption{
-		DimensionKind:  api.AgentNetworkConsumptionDimensionKind(c.DimensionKind),
-		DimensionId:    c.DimensionID,
-		WindowSeconds:  c.WindowSeconds,
-		WindowStartUtc: windowStart,
-		TokensInput:    c.TokensInput,
-		TokensOutput:   c.TokensOutput,
-		CostUsd:        c.CostUSD,
-		UpdatedAt:      &updatedAt,
-	}
-}

management/server/http/handlers/agentnetwork/guardrails_handler.go

@@ -1,171 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// addGuardrailEndpoints registers all Agent Network guardrail routes.
-func (h *handler) addGuardrailEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/guardrails", h.getAllGuardrails).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/guardrails", h.createGuardrail).Methods("POST", "OPTIONS")
-	router.HandleFunc("/agent-network/guardrails/{guardrailId}", h.getGuardrail).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/guardrails/{guardrailId}", h.updateGuardrail).Methods("PUT", "OPTIONS")
-	router.HandleFunc("/agent-network/guardrails/{guardrailId}", h.deleteGuardrail).Methods("DELETE", "OPTIONS")
-}
-
-func (h *handler) getAllGuardrails(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	guardrails, err := h.manager.GetAllGuardrails(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]*api.AgentNetworkGuardrail, 0, len(guardrails))
-	for _, g := range guardrails {
-		out = append(out, g.ToAPIResponse())
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func (h *handler) getGuardrail(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	guardrailID := mux.Vars(r)["guardrailId"]
-	if guardrailID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "guardrail ID is required"), w)
-		return
-	}
-
-	guardrail, err := h.manager.GetGuardrail(r.Context(), userAuth.AccountId, userAuth.UserId, guardrailID)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, guardrail.ToAPIResponse())
-}
-
-func (h *handler) createGuardrail(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkGuardrailRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validateGuardrail(&req); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	guardrail := types.NewGuardrail(userAuth.AccountId)
-	guardrail.FromAPIRequest(&req)
-
-	created, err := h.manager.CreateGuardrail(r.Context(), userAuth.UserId, guardrail)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
-}
-
-func (h *handler) updateGuardrail(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	guardrailID := mux.Vars(r)["guardrailId"]
-	if guardrailID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "guardrail ID is required"), w)
-		return
-	}
-
-	var req api.AgentNetworkGuardrailRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validateGuardrail(&req); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	guardrail := &types.Guardrail{
-		ID:        guardrailID,
-		AccountID: userAuth.AccountId,
-	}
-	guardrail.FromAPIRequest(&req)
-
-	updated, err := h.manager.UpdateGuardrail(r.Context(), userAuth.UserId, guardrail)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
-}
-
-func (h *handler) deleteGuardrail(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	guardrailID := mux.Vars(r)["guardrailId"]
-	if guardrailID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "guardrail ID is required"), w)
-		return
-	}
-
-	if err := h.manager.DeleteGuardrail(r.Context(), userAuth.AccountId, userAuth.UserId, guardrailID); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
-}
-
-func validateGuardrail(req *api.AgentNetworkGuardrailRequest) error {
-	if strings.TrimSpace(req.Name) == "" {
-		return status.Errorf(status.InvalidArgument, "name is required")
-	}
-
-	c := req.Checks
-	if c.ModelAllowlist.Enabled {
-		for _, id := range c.ModelAllowlist.Models {
-			if strings.TrimSpace(id) == "" {
-				return status.Errorf(status.InvalidArgument, "model_allowlist.models must not contain empty entries")
-			}
-		}
-	}
-	return nil
-}

management/server/http/handlers/agentnetwork/handlers_test.go

@@ -1,256 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/gorilla/mux"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/auth"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-const (
-	testAccountID = "acc-1"
-	testUserID    = "user-bob"
-)
-
-// agentNetworkHandlerFixture builds a real agentnetwork.Manager with
-// a sqlite store and an always-allow permissions mock, then exposes
-// the HTTP handlers via a gorilla router. Tests issue requests
-// through httptest and assert on the wire shape — the same path the
-// dashboard exercises.
-type agentNetworkHandlerFixture struct {
-	store   store.Store
-	manager agentnetwork.Manager
-	router  *mux.Router
-}
-
-func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("sqlite store not properly supported on Windows yet")
-	}
-	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
-
-	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(cleanUp)
-
-	ctrl := gomock.NewController(t)
-	perms := permissions.NewMockManager(ctrl)
-	// Always-allow: the handler tests are about wire shape, not
-	// authz. Authz is covered by the manager's own tests.
-	perms.EXPECT().
-		ValidateUserPermissions(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
-		Return(true, context.Background(), nil).
-		AnyTimes()
-
-	manager := agentnetwork.NewManager(st, perms, nil, nil)
-	h := &handler{manager: manager}
-
-	router := mux.NewRouter()
-	h.addPolicyEndpoints(router)
-	h.addConsumptionEndpoints(router)
-	h.addBudgetRuleEndpoints(router)
-	h.addSettingsEndpoints(router)
-
-	return &agentNetworkHandlerFixture{
-		store:   st,
-		manager: manager,
-		router:  router,
-	}
-}
-
-func (f *agentNetworkHandlerFixture) do(t *testing.T, method, path, body string) *httptest.ResponseRecorder {
-	t.Helper()
-	var reader io.Reader
-	if body != "" {
-		reader = strings.NewReader(body)
-	}
-	req := httptest.NewRequest(method, path, reader)
-	if body != "" {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
-		UserId:    testUserID,
-		AccountId: testAccountID,
-	})
-	rec := httptest.NewRecorder()
-	f.router.ServeHTTP(rec, req)
-	return rec
-}
-
-// seedProvider persists a minimal provider record so policy create
-// passes the manager's destination_provider_ids existence check.
-func (f *agentNetworkHandlerFixture) seedProvider(t *testing.T, id string) {
-	t.Helper()
-	require.NoError(t, f.store.SaveAgentNetworkProvider(context.Background(), &agentNetworkTypes.Provider{
-		ID:                id,
-		AccountID:         testAccountID,
-		ProviderID:        "openai_api",
-		Name:              "test-" + id,
-		UpstreamURL:       "https://api.openai.com",
-		APIKey:            "sk-test",
-		Enabled:           true,
-		SessionPrivateKey: "test-priv-key",
-		SessionPublicKey:  "test-pub-key",
-	}))
-}
-
-// TestPolicyHandler_WindowSecondsRoundTrip ports bash 10 to Go:
-// assert that a policy with window_seconds on both Token + Budget
-// halves round-trips through GET unchanged AND that legacy
-// window_hours / window_days are absent from the JSON response. We
-// seed the policy directly via the store rather than POST-ing
-// because the create path goes through the manager's
-// accountManager.StoreEvent which we don't wire in this fixture; the
-// on-wire shape is what matters here, and the POST validation path
-// is covered separately by the RejectsSubMinuteWindow test.
-func TestPolicyHandler_WindowSecondsRoundTrip(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	policy := &agentNetworkTypes.Policy{
-		ID:                     "ainpol_test",
-		AccountID:              testAccountID,
-		Name:                   "round-trip",
-		Enabled:                true,
-		SourceGroups:           []string{"grp-engineers"},
-		DestinationProviderIDs: []string{"prov-1"},
-		Limits: agentNetworkTypes.PolicyLimits{
-			TokenLimit:  agentNetworkTypes.PolicyTokenLimit{Enabled: true, GroupCap: 10000, UserCap: 5000, WindowSeconds: 86_400},
-			BudgetLimit: agentNetworkTypes.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 10.0, UserCapUsd: 2.5, WindowSeconds: 2_592_000},
-		},
-	}
-	require.NoError(t, f.store.SaveAgentNetworkPolicy(context.Background(), policy))
-
-	rec := f.do(t, http.MethodGet, "/agent-network/policies/"+policy.ID, "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkPolicy
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, int64(86_400), got.Limits.TokenLimit.WindowSeconds, "token_limit.window_seconds must round-trip")
-	assert.Equal(t, int64(2_592_000), got.Limits.BudgetLimit.WindowSeconds, "budget_limit.window_seconds must round-trip")
-
-	// Legacy field names must NOT appear in the response — would
-	// signal that the management server is still emitting the old
-	// shape and would fool a v1 dashboard into rendering days/hours.
-	assert.NotContains(t, rec.Body.String(), "window_hours",
-		"legacy window_hours field must be absent from the on-wire response")
-	assert.NotContains(t, rec.Body.String(), "window_days",
-		"legacy window_days field must be absent from the on-wire response")
-}
-
-// TestPolicyHandler_RejectsSubMinuteWindow ports bash 20 to Go: an
-// enabled limit with window_seconds < 60 must surface as a 4xx
-// because anything finer than per-minute produces an untenable
-// volume of consumption rows for a feature whose value comes from
-// per-window cap enforcement.
-func TestPolicyHandler_RejectsSubMinuteWindow(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-	f.seedProvider(t, "prov-1")
-
-	body := `{
-        "name": "sub-minute-window",
-        "enabled": true,
-        "source_groups": ["grp-engineers"],
-        "destination_provider_ids": ["prov-1"],
-        "guardrail_ids": [],
-        "limits": {
-            "token_limit": {"enabled": true, "group_cap": 10000, "user_cap": 5000, "window_seconds": 30},
-            "budget_limit": {"enabled": false, "group_cap_usd": 0, "user_cap_usd": 0, "window_seconds": 0}
-        }
-    }`
-	rec := f.do(t, http.MethodPost, "/agent-network/policies", body)
-	// 422 specifically (InvalidArgument) proves the window-validation path —
-	// a route miss would be 404 and an auth failure 403, so a generic 4xx
-	// would let those false-pass.
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"enabled token_limit with window_seconds<60 must be rejected as a validation error: got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "window_seconds",
-		"rejection body must name the offending window_seconds field, proving it's the validation path: %s", rec.Body.String())
-}
-
-// TestConsumptionHandler_EmptyAccountReturnsArray ports bash 30 to
-// Go: GET /agent-network/consumption on a clean account always
-// returns a JSON array (possibly empty), never a 404 / 500. The
-// dashboard depends on this shape to render its empty state.
-func TestConsumptionHandler_EmptyAccountReturnsArray(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodGet, "/agent-network/consumption", "")
-	require.Equal(t, http.StatusOK, rec.Code)
-
-	var rows []api.AgentNetworkConsumption
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &rows),
-		"response must always be a JSON array — even when empty: %s", rec.Body.String())
-	assert.Empty(t, rows)
-}
-
-// TestConsumptionHandler_PopulatedAccountListsRows mirrors the
-// /consumption read after a few RecordConsumption calls. Validates
-// the wire shape carries every field the dashboard reads (dim_kind,
-// dim_id, window_seconds, window_start_utc, tokens, cost_usd) and
-// rows are ordered window-newest-first.
-func TestConsumptionHandler_PopulatedAccountListsRows(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	require.NoError(t, f.manager.RecordConsumption(
-		context.Background(), testAccountID,
-		agentNetworkTypes.DimensionGroup, "grp-engineers",
-		86_400, 100, 50, 0.0125,
-	))
-	require.NoError(t, f.manager.RecordConsumption(
-		context.Background(), testAccountID,
-		agentNetworkTypes.DimensionUser, testUserID,
-		86_400, 100, 50, 0.0125,
-	))
-
-	rec := f.do(t, http.MethodGet, "/agent-network/consumption", "")
-	require.Equal(t, http.StatusOK, rec.Code)
-
-	var rows []api.AgentNetworkConsumption
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &rows))
-	require.Len(t, rows, 2, "two RecordConsumption calls must yield two rows")
-
-	// Index by dim_kind so we can assert the full wire shape of each row,
-	// including the dimension id and the aligned window start the dashboard
-	// keys on. Both rows share totals and window.
-	byKind := make(map[string]api.AgentNetworkConsumption, len(rows))
-	for _, row := range rows {
-		assert.Equal(t, int64(100), row.TokensInput)
-		assert.Equal(t, int64(50), row.TokensOutput)
-		assert.InDelta(t, 0.0125, row.CostUsd, 1e-9)
-		assert.Equal(t, int64(86_400), row.WindowSeconds)
-		assert.False(t, row.WindowStartUtc.IsZero(), "window_start_utc must be set on every row")
-		byKind[string(row.DimensionKind)] = row
-	}
-
-	groupRow, ok := byKind["group"]
-	require.True(t, ok, "group dimension must surface")
-	assert.Equal(t, "grp-engineers", groupRow.DimensionId, "group row must carry the source group id as dimension_id")
-
-	userRow, ok := byKind["user"]
-	require.True(t, ok, "user dimension must surface")
-	assert.Equal(t, testUserID, userRow.DimensionId, "user row must carry the user id as dimension_id")
-
-	// Both rows fall in the same aligned window (same length, recorded
-	// together), so window_start_utc must match across them.
-	assert.Equal(t, groupRow.WindowStartUtc, userRow.WindowStartUtc,
-		"rows recorded in the same window must share the aligned window_start_utc")
-}

management/server/http/handlers/agentnetwork/policies_handler.go

@@ -1,228 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// minWindowSeconds is the floor enforced on enabled token / budget
-// limit windows. One minute is short enough for fine-grained burst
-// control without producing untenable consumption-row volume at scale.
-const minWindowSeconds int64 = 60
-
-// addPolicyEndpoints registers all Agent Network policy routes on the
-// shared handler.
-func (h *handler) addPolicyEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/policies", h.getAllPolicies).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/policies", h.createPolicy).Methods("POST", "OPTIONS")
-	router.HandleFunc("/agent-network/policies/{policyId}", h.getPolicy).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/policies/{policyId}", h.updatePolicy).Methods("PUT", "OPTIONS")
-	router.HandleFunc("/agent-network/policies/{policyId}", h.deletePolicy).Methods("DELETE", "OPTIONS")
-}
-
-func (h *handler) getAllPolicies(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	policies, err := h.manager.GetAllPolicies(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]*api.AgentNetworkPolicy, 0, len(policies))
-	for _, p := range policies {
-		out = append(out, p.ToAPIResponse())
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func (h *handler) getPolicy(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	policyID := mux.Vars(r)["policyId"]
-	if policyID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "policy ID is required"), w)
-		return
-	}
-
-	policy, err := h.manager.GetPolicy(r.Context(), userAuth.AccountId, userAuth.UserId, policyID)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, policy.ToAPIResponse())
-}
-
-func (h *handler) createPolicy(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkPolicyRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validatePolicy(&req); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	policy := types.NewPolicy(userAuth.AccountId)
-	policy.FromAPIRequest(&req)
-
-	created, err := h.manager.CreatePolicy(r.Context(), userAuth.UserId, policy)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
-}
-
-func (h *handler) updatePolicy(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	policyID := mux.Vars(r)["policyId"]
-	if policyID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "policy ID is required"), w)
-		return
-	}
-
-	var req api.AgentNetworkPolicyRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validatePolicy(&req); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	policy := &types.Policy{
-		ID:        policyID,
-		AccountID: userAuth.AccountId,
-	}
-	policy.FromAPIRequest(&req)
-
-	updated, err := h.manager.UpdatePolicy(r.Context(), userAuth.UserId, policy)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
-}
-
-func (h *handler) deletePolicy(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	policyID := mux.Vars(r)["policyId"]
-	if policyID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "policy ID is required"), w)
-		return
-	}
-
-	if err := h.manager.DeletePolicy(r.Context(), userAuth.AccountId, userAuth.UserId, policyID); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
-}
-
-func validatePolicy(req *api.AgentNetworkPolicyRequest) error {
-	if strings.TrimSpace(req.Name) == "" {
-		return status.Errorf(status.InvalidArgument, "name is required")
-	}
-	if len(req.SourceGroups) == 0 {
-		return status.Errorf(status.InvalidArgument, "source_groups must contain at least one group id")
-	}
-	for _, id := range req.SourceGroups {
-		if strings.TrimSpace(id) == "" {
-			return status.Errorf(status.InvalidArgument, "source_groups must not contain empty entries")
-		}
-	}
-	if len(req.DestinationProviderIds) == 0 {
-		return status.Errorf(status.InvalidArgument, "destination_provider_ids must contain at least one provider id")
-	}
-	for _, id := range req.DestinationProviderIds {
-		if strings.TrimSpace(id) == "" {
-			return status.Errorf(status.InvalidArgument, "destination_provider_ids must not contain empty entries")
-		}
-	}
-	if req.GuardrailIds != nil {
-		for _, id := range *req.GuardrailIds {
-			if strings.TrimSpace(id) == "" {
-				return status.Errorf(status.InvalidArgument, "guardrail_ids must not contain empty entries")
-			}
-		}
-	}
-	if req.Limits != nil {
-		if err := validatePolicyLimits(*req.Limits); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func validatePolicyLimits(l api.AgentNetworkPolicyLimits) error {
-	if l.TokenLimit.Enabled {
-		if l.TokenLimit.WindowSeconds < minWindowSeconds {
-			return status.Errorf(status.InvalidArgument, "limits.token_limit.window_seconds must be at least %d (one minute) when enabled", minWindowSeconds)
-		}
-		if l.TokenLimit.GroupCap < 0 {
-			return status.Errorf(status.InvalidArgument, "limits.token_limit.group_cap must not be negative")
-		}
-		if l.TokenLimit.UserCap < 0 {
-			return status.Errorf(status.InvalidArgument, "limits.token_limit.user_cap must not be negative")
-		}
-		if l.TokenLimit.GroupCap == 0 && l.TokenLimit.UserCap == 0 {
-			return status.Errorf(status.InvalidArgument, "limits.token_limit requires group_cap or user_cap to be greater than zero when enabled")
-		}
-	}
-	if l.BudgetLimit.Enabled {
-		if l.BudgetLimit.WindowSeconds < minWindowSeconds {
-			return status.Errorf(status.InvalidArgument, "limits.budget_limit.window_seconds must be at least %d (one minute) when enabled", minWindowSeconds)
-		}
-		if l.BudgetLimit.GroupCapUsd < 0 {
-			return status.Errorf(status.InvalidArgument, "limits.budget_limit.group_cap_usd must not be negative")
-		}
-		if l.BudgetLimit.UserCapUsd < 0 {
-			return status.Errorf(status.InvalidArgument, "limits.budget_limit.user_cap_usd must not be negative")
-		}
-		if l.BudgetLimit.GroupCapUsd == 0 && l.BudgetLimit.UserCapUsd == 0 {
-			return status.Errorf(status.InvalidArgument, "limits.budget_limit requires group_cap_usd or user_cap_usd to be greater than zero when enabled")
-		}
-	}
-	return nil
-}

management/server/http/handlers/agentnetwork/providers_handler.go

@@ -1,217 +0,0 @@
-// Package agentnetwork serves the Agent Network HTTP API.
-//
-// All persistence is delegated to agentnetwork.Manager so this layer only
-// translates between the wire format (api.AgentNetworkProvider*) and the
-// domain types.
-package agentnetwork
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-type handler struct {
-	manager agentnetwork.Manager
-}
-
-// AddEndpoints registers all Agent Network routes.
-func AddEndpoints(manager agentnetwork.Manager, router *mux.Router) {
-	h := &handler{manager: manager}
-	router.HandleFunc("/agent-network/catalog/providers", h.getCatalogProviders).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/providers", h.getAllProviders).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST", "OPTIONS")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT", "OPTIONS")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.deleteProvider).Methods("DELETE", "OPTIONS")
-	h.addPolicyEndpoints(router)
-	h.addGuardrailEndpoints(router)
-	h.addSettingsEndpoints(router)
-	h.addConsumptionEndpoints(router)
-	h.addAccessLogEndpoints(router)
-	h.addBudgetRuleEndpoints(router)
-}
-
-func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
-	if _, err := nbcontext.GetUserAuthFromContext(r.Context()); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	entries := catalog.All()
-	out := make([]api.AgentNetworkCatalogProvider, 0, len(entries))
-	for _, e := range entries {
-		out = append(out, e.ToAPIResponse())
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func (h *handler) getAllProviders(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	providers, err := h.manager.GetAllProviders(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]*api.AgentNetworkProvider, 0, len(providers))
-	for _, p := range providers {
-		out = append(out, p.ToAPIResponse())
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func (h *handler) getProvider(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	providerID := mux.Vars(r)["providerId"]
-	if providerID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "provider ID is required"), w)
-		return
-	}
-
-	provider, err := h.manager.GetProvider(r.Context(), userAuth.AccountId, userAuth.UserId, providerID)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, provider.ToAPIResponse())
-}
-
-func (h *handler) createProvider(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkProviderRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validate(&req, true); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	provider := types.NewProvider(userAuth.AccountId)
-	provider.FromAPIRequest(&req)
-
-	bootstrapCluster := ""
-	if req.BootstrapCluster != nil {
-		bootstrapCluster = *req.BootstrapCluster
-	}
-
-	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider, bootstrapCluster)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
-}
-
-func (h *handler) updateProvider(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	providerID := mux.Vars(r)["providerId"]
-	if providerID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "provider ID is required"), w)
-		return
-	}
-
-	var req api.AgentNetworkProviderRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	if err := validate(&req, false); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	provider := &types.Provider{
-		ID:        providerID,
-		AccountID: userAuth.AccountId,
-	}
-	provider.FromAPIRequest(&req)
-
-	updated, err := h.manager.UpdateProvider(r.Context(), userAuth.UserId, provider)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
-}
-
-func (h *handler) deleteProvider(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	providerID := mux.Vars(r)["providerId"]
-	if providerID == "" {
-		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "provider ID is required"), w)
-		return
-	}
-
-	if err := h.manager.DeleteProvider(r.Context(), userAuth.AccountId, userAuth.UserId, providerID); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
-}
-
-func validate(req *api.AgentNetworkProviderRequest, requireAPIKey bool) error {
-	if strings.TrimSpace(req.ProviderId) == "" {
-		return status.Errorf(status.InvalidArgument, "provider_id is required")
-	}
-	if !catalog.IsKnown(req.ProviderId) {
-		return status.Errorf(status.InvalidArgument, "provider_id %q is not a known catalog provider", req.ProviderId)
-	}
-	if strings.TrimSpace(req.Name) == "" {
-		return status.Errorf(status.InvalidArgument, "name is required")
-	}
-	if strings.TrimSpace(req.UpstreamUrl) == "" {
-		return status.Errorf(status.InvalidArgument, "upstream_url is required")
-	}
-	u, err := url.Parse(strings.TrimSpace(req.UpstreamUrl))
-	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
-		return status.Errorf(status.InvalidArgument, "upstream_url must be a full http(s) URL")
-	}
-	if requireAPIKey && (req.ApiKey == nil || strings.TrimSpace(*req.ApiKey) == "") {
-		return status.Errorf(status.InvalidArgument, "api_key is required")
-	}
-	return nil
-}

management/server/http/handlers/agentnetwork/settings_handler.go

@@ -1,74 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// addSettingsEndpoints registers the Agent Network settings routes. The
-// settings row is bootstrapped server-side on first provider create; GET reads
-// it and PUT updates the mutable collection toggles (cluster/subdomain stay
-// immutable).
-func (h *handler) addSettingsEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
-}
-
-// updateSettings applies the collection toggles to the account's settings row.
-func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkSettingsRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	settings := &types.Settings{AccountID: userAuth.AccountId}
-	settings.FromAPIRequest(&req)
-
-	updated, err := h.manager.UpdateSettings(r.Context(), userAuth.UserId, settings)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
-}
-
-// getSettings returns the account's agent-network settings. The settings
-// row is bootstrapped on first provider create, so freshly-onboarded
-// accounts have nothing to read. Rather than 404-ing in that case (which
-// the dashboard would have to special-case), return a JSON null with 200
-// so consumers can branch on the body alone.
-func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		var sErr *status.Error
-		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
-			util.WriteJSONObject(r.Context(), w, nil)
-			return
-		}
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, settings.ToAPIResponse())
-}