From 8cbbea4536c4b3cc2a119869c547babe17399596 Mon Sep 17 00:00:00 2001
From: Dmitri Dolguikh <dmitri.external@netbird.io>
Date: Tue, 11 Aug 2026 14:46:59 +0200
Subject: [PATCH] support for GetAllowedUsers in sqlite

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
---
 .../network_map_db/pgsql/user_test.go         |  4 -
 .../network_map_db/sqlite/sqlite_store.go     |  4 -
 .../internals/network_map_db/sqlite/user.go   | 84 +++++++++++++++++++
 3 files changed, 84 insertions(+), 8 deletions(-)
 create mode 100644 management/internals/network_map_db/sqlite/user.go

diff --git a/integration_tests/management/network_map_db/pgsql/user_test.go b/integration_tests/management/network_map_db/pgsql/user_test.go
index 7f6813b5e..132f749e2 100644
--- a/integration_tests/management/network_map_db/pgsql/user_test.go
+++ b/integration_tests/management/network_map_db/pgsql/user_test.go
@@ -6,14 +6,10 @@ import (
 	"context"
 	"testing"
 
-	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestGetAllowedUsers(t *testing.T) {
-	if engine == string(types.SqliteStoreEngine) {
-		t.Skip()
-	}
 	ctx := context.TODO()
 
 	execQuery(t, ctx,
diff --git a/management/internals/network_map_db/sqlite/sqlite_store.go b/management/internals/network_map_db/sqlite/sqlite_store.go
index b2b0cd629..b8380db29 100644
--- a/management/internals/network_map_db/sqlite/sqlite_store.go
+++ b/management/internals/network_map_db/sqlite/sqlite_store.go
@@ -118,7 +118,3 @@ func CollectRowsForSqlite[T any](rows *sql.Rows) ([]T, error) {
 
 	return toret, nil
 }
-
-func (s *SqliteStoreConn) GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error) {
-	return nil, nil, nil
-}
diff --git a/management/internals/network_map_db/sqlite/user.go b/management/internals/network_map_db/sqlite/user.go
new file mode 100644
index 000000000..0bdda372e
--- /dev/null
+++ b/management/internals/network_map_db/sqlite/user.go
@@ -0,0 +1,84 @@
+package networkmap_sqlite
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+)
+
+const (
+	GetAllowedUserIdsQuery = `
+	select id, auto_groups
+	from users
+	where account_id=? and not blocked and not is_service_user
+	`
+
+	GetAllGroupIdQuery = `
+	select id from groups
+	where account_id=? and name='All'
+	`
+)
+
+func (sc *SqliteStoreConn) GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error) {
+	rows, err := sc.Conn.QueryContext(ctx, GetAllowedUserIdsQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	users, err := CollectRowsForSqlite[user](rows)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	rows, err = sc.Conn.QueryContext(ctx, GetAllGroupIdQuery, accountId)
+	if err != nil {
+		return nil, nil, err
+	}
+	allGroupIds, err := collectAllGroupIds(rows)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	userIdIdx := make(map[string]struct{})
+	groupIdToUserIds := make(map[string][]string)
+	for _, user := range users {
+		autogroups := make([]string, 0)
+		if err := json.Unmarshal(user.AutoGroups, &autogroups); err != nil {
+			return nil, nil, err
+		}
+		userIdIdx[user.ID] = struct{}{}
+		for _, groupId := range autogroups {
+			groupIdToUserIds[groupId] = append(groupIdToUserIds[groupId], user.ID)
+		}
+		for _, allgid := range allGroupIds {
+			groupIdToUserIds[allgid] = append(groupIdToUserIds[allgid], user.ID)
+		}
+	}
+
+	return userIdIdx, groupIdToUserIds, nil
+}
+
+func collectAllGroupIds(rows *sql.Rows) ([]string, error) {
+	defer rows.Close()
+	var toret []string
+
+	for rows.Next() {
+		var id string
+		err := rows.Scan(&id)
+		if err != nil {
+			return nil, err
+		}
+		toret = append(toret, id)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return toret, nil
+}
+
+type user struct {
+	ID         string
+	AutoGroups []byte
+}