Merge remote-tracking branch 'origin/main' into poc/certificate-posture

management/internals/network_map_db/sqlite/network_router.go

@@ -11,9 +11,11 @@ import (
 )
 
 const (
+	// Outer join: a groupless router must survive.
 	GetNetworkRouterQuery = `
 	select public_id, peer, network_id, masquerade, metric, enabled, peer_groups, group_peers.peer_id
-	from network_routers, json_each(peer_groups)
+	from network_routers
+	left join json_each(network_routers.peer_groups) on true
 	left join group_peers on group_peers.account_id=? and group_peers.group_id=json_each.value
 	where network_routers.account_id=?
 	`

management/internals/network_map_db/sqlite/user.go

@@ -42,17 +42,20 @@ func (sc *SqliteStoreConn) GetAllowedUsers(ctx context.Context, accountId string
 	userIdIdx := make(map[string]struct{})
 	groupIdToUserIds := make(map[string][]string)
 	for _, user := range users {
+		for _, allgid := range allGroupIds {
+			groupIdToUserIds[allgid] = append(groupIdToUserIds[allgid], user.ID)
+		}
+		userIdIdx[user.ID] = struct{}{}
 		autogroups := make([]string, 0)
+		if user.AutoGroups == nil {
+			continue
+		}
 		if err := json.Unmarshal(user.AutoGroups, &autogroups); err != nil {
 			return nil, nil, err
 		}
-		userIdIdx[user.ID] = struct{}{}
 		for _, groupId := range autogroups {
 			groupIdToUserIds[groupId] = append(groupIdToUserIds[groupId], user.ID)
 		}
-		for _, allgid := range allGroupIds {
-			groupIdToUserIds[allgid] = append(groupIdToUserIds[allgid], user.ID)
-		}
 	}
 
 	return userIdIdx, groupIdToUserIds, nil